CVE-2026-8445: justhtml before 1.12.0 Sanitizer Bypass via Markdown

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-23 · updated 2026-10-12
Weakness: CWE-79

Description

justhtml versions <= 1.11.0 (fixed in 1.12.0) do not sufficiently escape HTML-significant characters (angle brackets) in text nodes when converting a parsed document to Markdown via to_markdown(). While a small set of Markdown metacharacters are escaped, characters such as < and > are preserved, so untrusted input that is safe in to_html() — including entity-decoded text (e.g. <script>) or text from RCDATA/RAWTEXT-parsed elements like <title>, <textarea>, <noscript>, and <plaintext> — can be emitted as raw HTML in the Markdown output, enabling a sanitizer bypass and potential cross-site scripting when that output is rendered.

Affected products

EmilStenstrom justhtml: before 1.12.0 — fixed in 1.12.0

How to fix

Upgrade to a fixed version: EmilStenstrom justhtml 1.12.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-8445 or the next vulnerability affects your stack