CVE-2026-8445

Critical

Description

justhtml versions <= 1.11.0 (fixed in 1.12.0) do not sufficiently escape HTML-significant characters (angle brackets) in text nodes when converting a parsed document to Markdown via to_markdown(). While a small set of Markdown metacharacters are escaped, characters such as < and > are preserved, so untrusted input that is safe in to_html() — including entity-decoded text (e.g. <script>) or text from RCDATA/RAWTEXT-parsed elements like <title>, <textarea>, <noscript>, and <plaintext> — can be emitted as raw HTML in the Markdown output, enabling a sanitizer bypass and potential cross-site scripting when that output is rendered.

SeverityCritical

CVSS9.8

Exploit probability—

ProductJusthtml

PublishedAug 23, 2026

First seenAug 23, 2026

Weakness typeCWE-79Cross-site scripting (XSS)

How to fix

Update

justhtml1.12.0 or later

Vendor advisories

github.com/EmilStenstrom/justhtml/security/advisories/GHSA-3rcm-vjrc-p45j

Affected products

Product	Affected versions	Fixed in
justhtmlPyPI	v < 1.12.0	1.12.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.