Description

justhtml versions 0.9.0 through 1.21.0 contain a cross-site scripting vulnerability in to_markdown() where inline code spans fail to account for blank lines as block boundaries. Attackers can inject blank lines into code or pre element text to break the inline span, causing sanitized HTML to be emitted unescaped and re-parsed as live Markdown by compliant renderers.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-23T14:16:54.433Z",
  "pubdate": "2026-08-23T14:16:54.433Z",
  "executiveSummary": "A cross-site scripting (XSS) vulnerability exists within the justhtml library affecting versions 0.9.0 through 1.21.0. The flaw resides in the to_markdown() function, where inline code spans improperly handle blank lines by failing to recognize them as valid block boundaries. This validation oversight allows malicious actors to inject raw blank lines directly into code or pre element text constructs. By breaking the inline span containment, the affected function causes previously sanitized HTML strings to be emitted in an unescaped state. When subsequent compliant Markdown renderers process this output, the unescaped payloads are re-parsed as live Markdown and executable HTML structures, leading to arbitrary script execution within the context of the victim user's browser session. The vulnerability presents significant security risks for applications that rely on justhtml for converting untrusted HTML to Markdown formats prior to rendering. Successful exploitation requires an attacker to supply crafted input containing malicious HTML structures designed to manipulate block boundaries during the conversion process, impacting confidentiality and integrity across vulnerable implementations.",
  "technicalDetails": "The vulnerability is rooted in a parsing logic defect within the to_markdown() function of the justhtml library, specifically impacting versions 0.9.0 through 1.21.0. The vulnerable component fails to correctly enforce block boundary rules when processing inline code spans and pre elements. Under normal operational parameters, inline code spans are expected to treat specific structural characters as boundaries to ensure proper sanitization and escape sequences are maintained. However, the lack of robust handling for blank lines within these inline contexts allows untrusted input to prematurely terminate or escape the intended code span encapsulation.\nThe attack flow proceeds as follows: First, an attacker supplies a specially crafted HTML payload containing malicious content embedded within code or pre elements, purposefully introducing blank lines. Second, the vulnerable to_markdown() function processes this input, failing to recognize the injected blank lines as invalid block boundaries inside the inline span. Third, because the span is improperly broken, the sanitization logic fails to preserve the necessary escape mechanisms, causing the underlying HTML tags to be emitted in a raw, unescaped format in the generated Markdown output.\nFinally, when a compliant Markdown renderer subsequently processes the output generated by justhtml, it interprets the unescaped strings as live Markdown and embedded HTML rather than literal text. This results in the execution of injected JavaScript or malicious markup within the victim's browser context. The vulnerability does not require authentication or specific privilege levels from the attacker, provided the application accepts and processes untrusted HTML inputs through the vulnerable function. The network exposure is directly tied to the accessibility of the application endpoint utilizing the vulnerable justhtml version for Markdown conversion and rendering pipelines."
}