Is CVE-2026-8445 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8445 being exploited in the wild.

How severe is CVE-2026-8445?

Critical severity, with a CVSS score of 9.8, published 23 August 2026.

Which products and versions are affected?

justhtml (PyPI) ECOSYSTEM:introduced=0,fixed=1.12.0.

Is there a fix for CVE-2026-8445?

Yes. justhtml (PyPI): upgrade to 1.12.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-8445 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-8445?

Check whether you run justhtml (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8445: justhtml HTML escaping bypass in Markdown conversion

CVE-2026-8445 · Severity: critical · CVSS 9.8 · Published 2026-08-23

justhtml is a Python library that parses and converts HTML documents to other formats. Versions up to 1.11.0 fail to properly escape HTML angle brackets when converting documents to Markdown, allowing attackers to inject raw HTML tags into the Markdown output. When that Markdown is later rendered as HTML in a web application, it can lead to cross-site scripting (XSS) attacks, bypassing security measures that rely on converting untrusted HTML to Markdown as a sanitization technique.

Technologies: justhtml (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-8445 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8445 being exploited in the wild.
How severe is CVE-2026-8445?: Critical severity, with a CVSS score of 9.8, published 23 August 2026.
Which products and versions are affected?: justhtml (PyPI) ECOSYSTEM:introduced=0,fixed=1.12.0.
Is there a fix for CVE-2026-8445?: Yes. justhtml (PyPI): upgrade to 1.12.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-8445 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-8445?: Check whether you run justhtml (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

justhtml (PyPI): upgrade to 1.12.0 or later
```
pip install "justhtml>=1.12.0"
```

Technical details

The vulnerability is an improper output encoding issue (CWE-79) in justhtml's to_markdown() function. When converting parsed HTML documents to Markdown, the library escapes only a small set of Markdown metacharacters but leaves HTML-significant characters like < and > unescaped in text nodes. This means untrusted input that is safely rendered as text in HTML output (via to_html()) can become raw HTML in Markdown output—including entity-decoded text (e.g., &lt;script&gt; becomes <script>) and text from RCDATA/RAWTEXT elements such as <title>, <textarea>, <noscript>, and <plaintext>. An unauthenticated attacker can craft input containing malicious HTML tags that, when converted to Markdown and later rendered as HTML, execute arbitrary JavaScript in the victim's browser. The vulnerability is fixed in version 1.12.0.

Affected products

justhtml justhtml <= 1.11.0

Identifiers

CVE-2026-8445
GHSA-3rcm-vjrc-p45j

Timeline

2026-08-23: disclosed
2026-03-18: patched: Version 1.12.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.