CVE-2026-5389: justhtml before 1.13.0 XSS via code fence breakout

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-23 · updated 2026-10-12
Weakness: CWE-80

Description

justhtml versions before 1.13.0 contain a cross-site scripting vulnerability in the to_markdown() function when serializing attacker-controlled pre content. Attackers can place backticks inside sanitized pre elements to break out of fixed-length code fences, allowing raw HTML to execute when the generated Markdown is rendered by CommonMark or GFM-style renderers.

Affected products

EmilStenstrom justhtml: before 1.13.0 — fixed in 1.13.0

How to fix

Upgrade to a fixed version: EmilStenstrom justhtml 1.13.0. Check the vendor advisory for mitigations.

References

https://github.com/EmilStenstrom/justhtml/security/advisories/GHSA-5vp3-3cg6-2rq3
https://www.vulncheck.com/advisories/justhtml-before-xss-via-code-fence-breakout
https://github.com/EmilStenstrom/justhtml/security/advisories/GHSA-5vp3-3cg6-2rq3

Get alerted when CVE-2026-5389 or the next vulnerability affects your stack