CVE-2026-5389: justhtml before 1.13.0 XSS via code fence breakout
justhtml versions before 1.13.0 contain a cross-site scripting vulnerability in the tomarkdown() function when serializing attacker-controlled pre content. Attackers can place backticks inside sanitized pre elements to break out of fixed-length code fences, allowing raw HTML to execute when the generated Markdown is rendered by CommonMark or GFM-style renderers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
justhtmlto a version that resolves this vulnerability.Fixed in 1.13.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using justhtml before 1.13.0 are exposed if they pass attacker-controlled content through to_markdown() and later render the generated Markdown with a CommonMark- or GFM-style renderer.
What must an attacker be able to do to exploit it?
An attacker needs to supply content that reaches a sanitized pre element. By placing backticks in that content, they can break out of the fixed-length code fence emitted during Markdown serialization and cause raw HTML to execute when the Markdown is rendered.
Is user interaction required?
Yes. The supplied vector indicates user interaction is required. The issue becomes relevant when someone views content produced from the affected Markdown serialization and rendered by a vulnerable Markdown rendering flow.