Critical Flaws in HTML Sanitiser and Spreadsheet Library

Critical Flaws in HTML Sanitiser and Spreadsheet Library This episode examines five critical vulnerabilities published within 24 hours, all scoring CVSS 9.4 or above. Four CVEs affect justhtml, a Python HTML sanitisation library, exposing bypass techniques including encoded malicious URLs, mixed-case tag names, and downstream Markdown conversion flaws. The fifth, CVE-2026-78207, concerns exceljs-hardened, a Node.js spreadsheet library vulnerable to prototype pollution through malicious cell notes. Corrine explains the practical attack scenarios, including unauthenticated file upload exploitation, and provides clear remediation steps. The episode emphasises supply chain visibility, noting that while these vulnerabilities are not currently on CISA’s Known Exploited Vulnerabilities catalogue, they represent genuine risk for small businesses with affected dependencies. Guidance covers patch priorities, GDPR reporting obligations for sanitisation failures, and practical steps for establishing software inventory and NVD notification processes without significant cost. Chapters Introduction Corrine introduces five critical vulnerabilities published within 24 hours, all in underlying software libraries rather than headline applications, and explains why they matter to UK small businesses. The justhtml Cluster: Four CVEs, One Library Detailed examination of four vulnerabilities in justhtml, a Python HTML sanitisation library. Covers CVE-2026-5388 (URL helpers and Markdown passthrough bypasses), CVE-2026-7808 (mixed-case tag names), and CVE-2026-8445 (Markdown conversion function failures), all scoring CVSS 9.8. Call to Action Brief pause encouraging listeners to follow the show and share with other small business owners. exceljs-hardened: Prototype Pollution in a Spreadsheet Tool Analysis of CVE-2026-78207, a CVSS 9.4 prototype pollution vulnerability in exceljs-hardened affecting versions below 5.0.0. Explains the attack mechanism through malicious spreadsheet uploads and realistic exploitation scenarios. What the Data Actually Tells You Contextualises the vulnerabilities by noting their absence from CISA’s Known Exploited Vulnerabilities catalogue, and provides calibrated guidance on prioritisation and remediation timelines. Supply Chain Visibility and What It Costs You Discusses the commercial value of supply chain visibility, procurement tender requirements, practical steps for establishing software inventory, and UK GDPR obligations regarding known vulnerabilities. Conclusion Summary of the five vulnerabilities, specific version upgrade requirements, and practical next steps for small businesses including setting up NVD notifications and establishing baseline dependency awareness. Links https://nvd.nist.gov/vuln/detail/CVE-2026-5388 https://nvd.nist.gov/vuln/detail/CVE-2026-7808 https://nvd.nist.gov/vuln/detail/CVE-2026-8445 https://nvd.nist.gov/vuln/detail/CVE-2026-78207 https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://www.ncsc.gov.uk/collection/supply-chain-security https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/