CVE-2026-9769

CVE-2026-9769 in justhtml isn't just about unbounded recursion—it's about where that recursion executes. The `_populate_selectedcontent()` method runs automatically inside `TreeBuilder.finish()`, which fires during object construction, not during any explicit processing call. When you call `JustHTML(untrusted_input)`, the library silently performs recursive DOM traversal on data you supplied before you ever get control back. This is the core architectural failure: the trust boundary isn't just crossed at parse time, it's violated again during an invisible post-parse operation that the user never consented to run. The practical impact is worse than a DoS. Since the crash occurs in `__init__`, it bypasses any exception handling the caller has in place. If justhtml is embedded in a web server or data pipeline, one nested payload doesn't just crash the attacker—it terminates the worker process, potentially corrupting shared state and triggering cascade failures. Your try/except never fires because the explosion happens before you catch it. The 1.10.0 patch adds depth bounding to `_find_elements()`, which is a reasonable immediate fix. But depth bounding a traversal method inside an automatic `finish()` call is a patch on a patch. The real architectural question is whether `finish()` should ever perform complex traversals on untrusted-derived trees as an automatic side effect. A properly designed library would make post-parse traversal explicit and opt-in, not invisible and mandatory. Audit your codebase for other post-parse operations that run automatically. Check whether any HTML parsing libraries you use perform traversal or processing during construction. If they do, treat that as an implicit attack surface—any nested payload that triggers recursion will crash your process before your error handling gets a chance. Consider wrapping library constructors in subprocess isolation if the dependency can't be updated, and log RecursionErrors as potential security events rather than application bugs.

Reviewed through automated stages and approved by a human before publication.