[GHSA-v7cf-c9rm-wm3j] Add CVE-2026-9769 and justhtml 1.10.0 fix commits

[SebTardif]

Summary

Add the public CVE alias and the justhtml 1.10.0 security fix commits to GHSA-v7cf-c9rm-wm3j.

The advisory already has the correct PyPI package and fixed: 1.10.0 range. It does not list CVE-2026-9769, and its only code reference is the v1.10.0 release tag.

Evidence

CVE-2026-9769 is the same issue. The CNA record title is "justhtml before 1.10.0 Denial of Service via deeply nested HTML", the affected range is < 1.10.0, and the first reference is this GHSA:

• https://www.cve.org/CVERecord?id=CVE-2026-9769
• GHSA-v7cf-c9rm-wm3j

The v1.10.0 release commit (5095a058) only bumps pyproject.toml. The security work is the three commits immediately before it:

• EmilStenstrom/justhtml@a60467d (security: implement iterative cloning for deep trees)
• EmilStenstrom/justhtml@9226fd0 (security: Implement non-recursive handling for deeply nested nodes)
• EmilStenstrom/justhtml@fd2abec (security: Document iterative traversal implementation)

PyPI has both 1.9.1 and 1.10.0.

Change

One file: advisories/github-reviewed/2026/03/GHSA-v7cf-c9rm-wm3j/GHSA-v7cf-c9rm-wm3j.json

• aliases: add CVE-2026-9769
• references: add the three commit URLs (same WEB type used on other reviewed advisories)
• modified: 2026-08-23T16:37:15Z

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[advisory-database]

Hi @SebTardif! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!