CVE-2026-8445
CriticalCVSS 9.8Summary
justhtml versions <= 1.11.0 (fixed in 1.12.0) do not sufficiently escape HTML-significant characters (angle brackets) in text nodes when converting to Markdown. Characters like < and > are preserved, allowing raw HTML injection into Markdown output, bypassing sanitization and potentially leading to XSS.
Risk Assessment
The organization may be exposed to XSS attacks if user-supplied input is processed by to_markdown() and rendered in a browser. An attacker can inject malicious scripts that execute in the application context.
Recommendation
Update justhtml to version 1.12.0 or later. If updating is not possible, avoid using to_markdown() on untrusted input or additionally sanitize the output.
Original NVD description (English source)
justhtml versions <= 1.11.0 (fixed in 1.12.0) do not sufficiently escape HTML-significant characters (angle brackets) in text nodes when converting a parsed document to Markdown via to_markdown(). While a small set of Markdown metacharacters are escaped, characters such as < and > are preserved, so untrusted input that is safe in to_html() — including entity-decoded text (e.g. <script>) or text from RCDATA/RAWTEXT-parsed elements like <title>, <textarea>, <noscript>, and <plaintext> — can be emitted as raw HTML in the Markdown output, enabling a sanitizer bypass and potential cross-site scripting when that output is rendered.