CVE-2026-8445: justhtml before 1.12.0 Sanitizer Bypass via Markdown
justhtml versions <= 1.11.0 (fixed in 1.12.0) do not sufficiently escape HTML-significant characters (angle brackets) in text nodes when converting a parsed document to Markdown via tomarkdown(). While a small set of Markdown metacharacters are escaped, characters such as < and > are preserved, so untrusted input that is safe in tohtml() — including entity-decoded text (e.g. <script>) or text from RCDATA/RAWTEXT-parsed elements like <title>, <textarea>, <noscript>, and <plaintext> — can be emitted as raw HTML in the Markdown output, enabling a sanitizer bypass and potential cross-site scripting when that output is rendered.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
justhtmlto a version that resolves this vulnerability.Fixed in 1.12.0
Event History
Frequently Asked Questions
Which uses are exposed to this issue?
Applications are exposed when they process untrusted HTML with affected justhtml versions, convert it using to_markdown(), and later render the resulting Markdown in a context that permits raw HTML. Input that appears safe in to_html() can become unsafe after this conversion.
What attacker-controlled input can trigger the bypass?
An attacker can use angle-bracket HTML embedded in text nodes, including text produced by decoded entities such as <script>. Text originating from RCDATA or RAWTEXT-parsed elements, including title, textarea, noscript, and plaintext, can also be emitted as raw HTML in the Markdown output.
Are default escaping protections sufficient?
No. Affected versions escape only a limited set of Markdown metacharacters and preserve HTML-significant characters such as < and >, which allows the generated Markdown to contain raw HTML.
What version resolves the issue?
Upgrade to justhtml 1.12.0. Versions 1.11.0 and earlier are affected.