Critical Flaws in HTML Sanitiser and Spreadsheet Library
Critical Flaws in HTML Sanitiser and Spreadsheet Library
This episode examines five critical vulnerabilities published within 24 hours, all scoring CVSS 9.4 or above. Four CVEs affect justhtml, a Python HTML sanitisation library, exposing bypass techniques including encoded malicious URLs, mixed-case tag names, and downstream Markdown conversion flaws. The fifth, CVE-2026-78207, concerns exceljs-hardened, a Node.js spreadsheet library vulnerable to prototype pollution through malicious cell notes. Corrine explains the practical attack scenarios, including unauthenticated file upload…
The skinny
The skinny isn't ready yet — notes appear once the transcript is processed.