CVE-2026-8445

Name of the Vulnerable Software and Affected Versions justhtml versions prior to 1.12.0

Description Insufficient escaping of HTML-significant characters, specifically angle brackets, occurs in text nodes during the conversion of a parsed document to Markdown using the to markdown() function. While some Markdown metacharacters are escaped, characters like < and > are preserved. This allows untrusted input—such as entity-decoded text or content from RCDATA/RAWTEXT-parsed elements like , <textarea>, <noscript>, and <plaintext>—to be emitted as raw HTML in the Markdown output. This behavior can lead to a sanitizer bypass and potential cross-site scripting when the output is rendered.

Recommendations Update to version 1.12.0.