Description
justhtml versions before 1.13.0 contain a cross-site scripting vulnerability in the to_markdown() function when serializing attacker-controlled pre content. Attackers can place backticks inside sanitized pre elements to break out of fixed-length code fences, allowing raw HTML to execute when the generated Markdown is rendered by CommonMark or GFM-style renderers.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| EmilStenstrom | justhtml | < 1.13.0 | 1.13.0 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | justhtml | < 1.13.0 | 1.13.0 | GHSA-5vp3-3cg6-2rq3 |
References
- GitHub Security Advisory (GHSA-5vp3-3cg6-2rq3) vendor-advisory
- VulnCheck Advisory: justhtml before 1.13.0 XSS via code fence breakout third-party-advisory