CVE-2026-5389

Medium

Description

justhtml versions before 1.13.0 contain a cross-site scripting vulnerability in the to_markdown() function when serializing attacker-controlled pre content. Attackers can place backticks inside sanitized pre elements to break out of fixed-length code fences, allowing raw HTML to execute when the generated Markdown is rendered by CommonMark or GFM-style renderers.

SeverityMedium

CVSS6.1

Exploit probability—

ProductJusthtml

PublishedAug 23, 2026

First seenAug 23, 2026

Weakness typeCWE-80CWE-80

How to fix

Update

justhtml1.13.0 or later

Vendor advisories

github.com/EmilStenstrom/justhtml/security/advisories/GHSA-5vp3-3cg6-2rq3

Affected products

Product	Affected versions	Fixed in
justhtmlPyPI	v < 1.13.0	1.13.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.