[GHSA-v7cf-c9rm-wm3j] Add CVE-2026-9769 and justhtml 1.10.0 fix commits

[SebTardif]

Summary

Add the public CVE alias and the justhtml 1.10.0 security fix commits to GHSA-v7cf-c9rm-wm3j.

The advisory already has the correct PyPI package and fixed: 1.10.0 range. It does not list CVE-2026-9769, and its only code reference is the v1.10.0 release tag.

Evidence

CVE-2026-9769 is the same issue. The CNA record title is "justhtml before 1.10.0 Denial of Service via deeply nested HTML", the affected range is < 1.10.0, and the first reference is this GHSA:

• https://www.cve.org/CVERecord?id=CVE-2026-9769
• GHSA-v7cf-c9rm-wm3j

The v1.10.0 release commit (5095a058) only bumps pyproject.toml. The security work is the three commits immediately before it:

• EmilStenstrom/justhtml@a60467d (security: implement iterative cloning for deep trees)
• EmilStenstrom/justhtml@9226fd0 (security: Implement non-recursive handling for deeply nested nodes)
• EmilStenstrom/justhtml@fd2abec (security: Document iterative traversal implementation)

PyPI has both 1.9.1 and 1.10.0.

Change

One file: advisories/github-reviewed/2026/03/GHSA-v7cf-c9rm-wm3j/GHSA-v7cf-c9rm-wm3j.json

• aliases: add CVE-2026-9769
• references: add the three commit URLs (same WEB type used on other reviewed advisories)
• modified: 2026-08-23T16:37:15Z

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.