August 24 Security Briefing: justhtml, StackGres, and Tenda Vulnerabilities

The three issues in this briefing were newly recorded as CVEs, but they sit at very different security boundaries. justhtml matters where applications transform untrusted HTML and Markdown. StackGres concerns the boundary between a database owner and privileged monitoring components in a multi-tenant PostgreSQL platform. Tenda CH22 concerns reachability of a wireless appliance's web-management plane. Prioritization should begin with deployment context and input reachability, not the headline score alone.

The common question is where untrusted input, tenant privileges, or management access meets a more privileged processing boundary.

New justhtml CVE assignments

Several new CVE identifiers now map to existing justhtml project advisories. CVE-2026-8445 covers insufficient escaping when parsed content is converted to Markdown. Text that remains harmless in HTML output can become raw HTML when a downstream Markdown renderer parses it again. Versions through 1.11.0 are affected and 1.12.0 contains the fix. Applications that sanitize HTML, convert it to Markdown, and later render that Markdown should test the complete round trip rather than only the first sanitizer output.

CVE-2026-5388 covers issues in versions before 1.15.0 across URL-cleaning helpers, programmatic HTML serialization, Markdown passthrough, and custom sanitization policies. Encoded script schemes, backslash-based URLs, markup-breaking node names, raw textarea terminators, and preserved active elements can change meaning between processing stages. The project recommends 1.15.0 and advises avoiding html_passthrough for untrusted content and limiting risky custom-policy allowances when an immediate update is not possible.

CVE-2026-7808 affects advanced paths in versions through 1.15.0, including reused or mutated policy objects, programmatic DOM input, mixed-case script or style nodes, and custom policies that preserve SVG or MathML. The normal JustHTML(..., sanitize=True) path for ordinary parsed HTML is not described as uniformly affected. The project recommends updating to 1.16.0. Two additional assignments, CVE-2026-77088 and CVE-2026-74793, cover Markdown code-span handling and selectedcontent projection respectively, with fixes in 1.22.0 and 3.11.0.

• Identify the deployed justhtml version from dependency manifests and lock files.
• Locate to_markdown, html_passthrough, programmatic DOM, and custom policy usage.
• Test the full sanitizer-to-Markdown-to-renderer chain with security regression cases.
• Retest content compatibility after updating the package.

StackGres tenant privilege path

CVE-2026-78155 concerns a reported StackGres privilege path in Kubernetes-hosted PostgreSQL. The public StackGres work item describes how a lower-privileged tenant that owns a database could influence an unpinned search path and a privileged dblink connection used by metrics-exporter, potentially crossing from database ownership into pod-level command execution. The report identifies StackGres 1.x through 1.18.8 and a 1.19 development snapshot.

This is not merely an internet-facing console inventory problem. Defenders should determine whether StackGres provides a shared database platform, whether separate teams or customers receive database-owner rights, and how metrics-exporter connects to those databases. A dedicated cluster operated by one trusted team presents a different priority from a shared cluster where tenants control database objects and search paths.

Review database ownership, extension rights, exporter accounts, search-path settings, and dblink privileges as one chain. Kubernetes controls also shape the possible impact after a boundary crossing: service-account permissions, container users, writable filesystems, and network policies should be assessed together. Shared environments should be handled conservatively until the tenant-to-exporter trust boundary is clearly documented.

• Map StackGres versions together with metrics-exporter deployment state.
• Prioritize shared clusters with tenant database-owner privileges.
• Review exporter accounts, search paths, and dblink privileges.
• Reduce downstream impact with pod security, service-account, and network controls.

Tenda CH22 web-management command injection

CVE-2026-78063 identifies command injection in the Tenda CH22 1.0.0.1 web-management function formeditFileName at /goform/editFileName. Manipulating the editNameMit argument can cross from a web request into operating-system command handling, and the record includes public reproduction material. The relevant boundary is the management HTTP interface, not the wireless encryption protocol.

Start by matching the exact CH22 model and 1.0.0.1 firmware, then inspect which networks can reach the management port. Exposure to the internet, guest Wi-Fi, or ordinary user VLANs raises priority. A dedicated management VLAN, firewall allowlist, and VPN or jump-host path can reduce reachable attack conditions. Record model, firmware, and management reachability together rather than treating a device-search result as sufficient evidence.

Operational containment should focus on isolating the management plane. Block web administration from WAN and general user networks, allow only necessary administrator addresses, and use unique credentials. Review reverse-proxy or firewall logs for requests to /goform/editFileName and unusually long filename parameters. Maintain a configuration backup and a known recovery procedure so the appliance can be restored quickly if behavior changes.

• Identify Tenda CH22 devices running firmware 1.0.0.1.
• Block web administration from the internet, guest, and general user networks.
• Use a dedicated management VLAN, allowlist, and unique credentials.
• Review request and configuration logs for the affected path and unusual input.

Priority for today

Prioritize according to exposure and data flow. For public-facing applications, inspect justhtml versions and transformation paths. For shared StackGres platforms, focus on the combination of tenant ownership and exporter privileges. For Tenda CH22, isolate devices whose management interfaces are broadly reachable. Assign each item to the team that owns its boundary: application processing, database platform permissions, or network-device management.