CyberRota Analysis
AI-GeneratedVersions of justhtml up to 1.11.0 are vulnerable due to inadequate escaping of HTML-significant characters when converting documents to Markdown, allowing untrusted input to be rendered as raw HTML. This flaw can lead to a sanitizer bypass and potential cross-site scripting (XSS) vulnerabilities when the output is displayed. Organizations using this software should prioritize updating to version 1.12.0 or later to mitigate these critical security risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
justhtml versions <= 1.11.0 (fixed in 1.12.0) do not sufficiently escape HTML-significant characters (angle brackets) in text nodes when converting a parsed document to Markdown via to_markdown(). While a small set of Markdown metacharacters are escaped, characters such as < and > are preserved, so untrusted input that is safe in to_html() — including entity-decoded text (e.g. <script>) or text from RCDATA/RAWTEXT-parsed elements like <title>, <textarea>, <noscript>, and <plaintext> — can be emitted as raw HTML in the Markdown output, enabling a sanitizer bypass and potential cross-site scripting when that output is rendered.