Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
JustHTML: Untrusted Input Can Become Raw HTML in Markdown Output
published 11 days ago
Summary
JustHTML's Markdown conversion can leave untrusted input unchanged, potentially executing malicious scripts. This is a concern when allowing user-generated content. To mitigate, ensure you're using the `html_passthrough=False` option when converting to Markdown.
What to do
- Update justhtml to version 1.12.0.
- Update emilstenstrom justhtml to version 1.12.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| PyPI | – | justhtml |
< 1.12.0 Fix: upgrade to 1.12.0
|
| – | emilstenstrom | justhtml | < 1.12.0 |
Original advisory text
justhtml before 1.12.0 Sanitizer Bypass via Markdown
justhtml versions <= 1.11.0 (fixed in 1.12.0) do not sufficiently escape HTML-significant characters (angle brackets) in text nodes when converting a parsed document to Markdown via to_markdown(). While a small set of Markdown metacharacters are escaped, characters such as < and > are preserved, so untrusted input that is safe in to_html() — including entity-decoded text (e.g. <script>) or text from RCDATA/RAWTEXT-parsed elements like <title>, <textarea>, <noscript>, and <plaintext> — can be emitted as raw HTML in the Markdown output, enabling a sanitizer bypass and potential cross-site scripting when that output is rendered.
Severity
9.3
Critical
CVSS 4.0: 7.5 (OSV)
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published23 Aug 2026
Updated24 Aug 2026
First seen18 Mar 2026
Sources
GHSA-3rcm-vjrc-p45j · OSV
Monitor software like this
Free during beta