Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-8445: JustHTML Can Produce Malicious HTML Output
CVE-2026-8445 · published 11 days ago
Summary
JustHTML can create malicious HTML when converting certain text inputs to Markdown. This can allow an attacker to inject malicious code into your website. To fix this, you should update to the latest version of JustHTML and ensure that you're using it correctly to prevent security risks. Check your code and update as necessary.
What to do
- Update justhtml to version 1.12.0.
- Update emilstenstrom justhtml to version 1.12.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| pip | – | justhtml |
<= 1.11.0 Fix: upgrade to 1.12.0
|
| – | emilstenstrom | justhtml | < 1.12.0 |
Original advisory text
justhtml before 1.12.0 Sanitizer Bypass via Markdown
justhtml versions <= 1.11.0 (fixed in 1.12.0) do not sufficiently escape HTML-significant characters (angle brackets) in text nodes when converting a parsed document to Markdown via to_markdown(). While a small set of Markdown metacharacters are escaped, characters such as < and > are preserved, so untrusted input that is safe in to_html() — including entity-decoded text (e.g. <script>) or text from RCDATA/RAWTEXT-parsed elements like <title>, <textarea>, <noscript>, and <plaintext> — can be emitted as raw HTML in the Markdown output, enabling a sanitizer bypass and potential cross-site scripting when that output is rendered.
References
- https://github.com/EmilStenstrom/justhtml/security/advisories/GHSA-3rcm-vjrc-p45...
- https://github.com/advisories/GHSA-3rcm-vjrc-p45j
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8445.j... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-8445 Vendor Advisory
- https://www.vulncheck.com/advisories/justhtml-before-sanitizer-bypass-via-markdo... Vendor Advisory
Severity
9.9
Critical
CVSS 4.0: 5.3 (GHSA)
CVSS 4.0: 9.3 (NVD)
CVSS 3.1: 9.8 (NVD)
Exploitation
EPSS <1%
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published23 Aug 2026
Updated2 Sep 2026
First seen18 Mar 2026
Monitor software like this
Free during beta