Description
justhtml versions <= 1.11.0 (fixed in 1.12.0) do not sufficiently escape HTML-significant characters (angle brackets) in text nodes when converting a parsed document to Markdown via to_markdown(). While a small set of Markdown metacharacters are escaped, characters such as < and > are preserved, so untrusted input that is safe in to_html() — including entity-decoded text (e.g. <script>) or text from RCDATA/RAWTEXT-parsed elements like
, <textarea>, <noscript>, and <plaintext> — can be emitted as raw HTML in the Markdown output, enabling a sanitizer bypass and potential cross-site scripting when that output is rendered.</p></div>
<div class="ds"><h2>Affected Platforms</h2><div><span class="ptag">Unknown</span></div></div>
<div class="ds"><h2>Weakness Type</h2><p>CWE-79</p></div>
<div class="ds"><h2>References</h2><ul style="list-style:none;display:flex;flex-direction:column;gap:0.4rem;"><li><a href="https://github.com/EmilStenstrom/justhtml/security/advisories/GHSA-3rcm-vjrc-p45j" target="_blank" rel="noopener">https://github.com/EmilStenstrom/justhtml/security/advisories/GHSA-3rcm-vjrc-p45…</a></li><li><a href="https://www.vulncheck.com/advisories/justhtml-before-sanitizer-bypass-via-markdown" target="_blank" rel="noopener">https://www.vulncheck.com/advisories/justhtml-before-sanitizer-bypass-via-markdo…</a></li><li><a href="https://github.com/EmilStenstrom/justhtml/security/advisories/GHSA-3rcm-vjrc-p45j" target="_blank" rel="noopener">https://github.com/EmilStenstrom/justhtml/security/advisories/GHSA-3rcm-vjrc-p45…</a></li></ul></div>
</div>
<div class="wrap"><footer><span>© 2025 Artfical DT</span><div style="display:flex;gap:1.2rem;"><a href="/privacy?lang=en">Privacy Policy</a><a href="https://artfical.com">artfical.com</a></div></footer></div>
<script src="/__defend3r/badge.js" defer data-defend3r="1" data-position="br"></script></body></html>