Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
justhtml versions are preserved, so untrusted input that is safe in to_html() — including entity-decoded text (e.g. ) or text from RCDATA/RAWTEXT-parsed elements like , , , and — can be emitted as raw HTML in the Markdown output, enabling a sanitizer bypass and potential cross-site scripting when that output is rendered.
An unauthenticated attacker can supply untrusted input to the to_markdown() function that bypasses HTML sanitization and injects raw HTML (including JavaScript code) into the Markdown output, enabling cross-site scripting attacks when the output is rendered.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Yes, a patch is available in justhtml version 1.12.0 and later.
Upgrade justhtml to version 1.12.0 or later. If immediate upgrade is not possible, avoid using to_markdown() with untrusted input, or implement additional output encoding when rendering Markdown that may contain user-supplied content.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD published the first details for CVE-2026-8445
A CVSS base score of 9.8 has been assigned.
Feedly found the first article mentioning CVE-2026-8445 . See article
GitHub Advisories released a security advisory .
A critical sanitizer bypass vulnerability in justhtml versions up to 1.11.0, with a CVSS score of 9.8, allows untrusted input to be emitted as raw HTML during Markdown conversion, potentially leading to cross-site scripting (XSS) attacks. There are no public proof-of-concept exploits available, but users are advised to upgrade to version 1.12.0 or newer to mitigate the risk. The vulnerability affects any application using the vulnerable justhtml library for converting HTML to Markdown, posing a significant threat to systems that render the resulting Markdown output. See article
[GHSA-wf6m-786j-gxrr] justhtml versions <= 1.11.0 (fixed in 1.12.0) do not sufficiently escape HTML-si
justhtml Critical Sanitization Bypass (CVE-2026-5388)
justhtml Sanitizer Bypass to XSS (CVE-2026-8445)
CVE-2026-8445 - Exploits & Severity - Feedly
justhtml Critical Sanitization Bypass (CVE-2026-5388)
🚨 CVE-2026-8445 — CVSS 9.3 CRITICAL justhtml versions <= 1.11.0 (fixed in 1.12.0) do not sufficiently escape HTML-significant characters (angle... 🔎 #CVE #CyberSecurity #InfoSec
CVE-2026-8445 - justhtml before 1.12.0 Sanitizer Bypass via Markdown CVE ID : CVE-2026-8445 Published : Aug. 23, 2026, 2:16 p.m. | 1 hour, 43 minutes ago Description : justhtml versions <= 1.11.0 (fixed in 1.12.0) do not sufficiently escape HTML-significant characters...
Collect, analyze, and vulnerability reports faster using AI
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
