Executive brief
A vulnerability in the justhtml library allows attackers to execute malicious scripts in a user's browser. The library, which converts HTML to Markdown, fails to properly handle blank lines within code elements, allowing specially crafted text to 'break out' and be treated as active HTML. This could lead to unauthorized actions being performed in a user's session or the theft of sensitive information like login cookies.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in justhtml's to_markdown() function due to improper output encoding (CWE-116). When processing <code> tags or <pre> tags inside links, the library uses inline Markdown code spans. According to CommonMark specifications, inline code spans cannot contain blank lines (\n\n); if a blank line is present, the span is terminated prematurely. Because justhtml does not HTML-escape the content of these spans, any content following the blank line is treated as raw HTML by the Markdown renderer. An attacker can exploit this by providing HTML containing a blank line followed by a malicious payload (e.g., <img onerror=...>). The vulnerability is present in versions 0.9.0 through 1.21.0 and is fixed in version 1.22.0.
Affected products
- EmilStenstrom justhtml >= 0.9.0, <= 1.21.0
Timeline
- 2026-05-22: advisory: Advisory published on GitHub
- 2026-06-25: disclosed: Final disclosure date
- 2026-06-25: patched: Version 1.22.0 released