Executive brief
justhtml is a Python library that parses and converts HTML documents to other formats. Versions up to 1.11.0 fail to properly escape HTML angle brackets when converting documents to Markdown, allowing attackers to inject raw HTML tags into the Markdown output. When that Markdown is later rendered as HTML in a web application, it can lead to cross-site scripting (XSS) attacks, bypassing security measures that rely on converting untrusted HTML to Markdown as a sanitization technique.
Technical details
The vulnerability is an improper output encoding issue (CWE-79) in justhtml's to_markdown() function. When converting parsed HTML documents to Markdown, the library escapes only a small set of Markdown metacharacters but leaves HTML-significant characters like < and > unescaped in text nodes. This means untrusted input that is safely rendered as text in HTML output (via to_html()) can become raw HTML in Markdown output—including entity-decoded text (e.g., &lt;script&gt; becomes <script>) and text from RCDATA/RAWTEXT elements such as <title>, <textarea>, <noscript>, and <plaintext>. An unauthenticated attacker can craft input containing malicious HTML tags that, when converted to Markdown and later rendered as HTML, execute arbitrary JavaScript in the victim's browser. The vulnerability is fixed in version 1.12.0.
Affected products
- justhtml justhtml <= 1.11.0
Timeline
- 2026-08-23: disclosed
- 2026-03-18: patched: Version 1.12.0 released