CVE-2026-5389
Received Received - Intake

Cross-Site Scripting in justhtml via Markdown Serialization

Publication date: 2026-08-23

Last updated on: 2026-08-23

Assigner: VulnCheck

Description
justhtml versions before 1.13.0 contain a cross-site scripting vulnerability in the to_markdown() function when serializing attacker-controlled pre content. Attackers can place backticks inside sanitized pre elements to break out of fixed-length code fences, allowing raw HTML to execute when the generated Markdown is rendered by CommonMark or GFM-style renderers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-23
Last Modified
2026-08-23
Generated
2026-08-23
AI Q&A
2026-08-23
EPSS Evaluated
N/A
NVD
CVE-2026-5389
EUVD
EUVD-2026-64653

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-80 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a cross-site scripting (XSS) vulnerability in justhtml versions before 1.13.0. It occurs in the to_markdown() function when handling pre-formatted content. Attackers can inject backticks into sanitized pre elements to break out of fixed-length code fences, allowing raw HTML to execute when the generated Markdown is rendered by CommonMark or GFM-style renderers.

Detection Guidance

Check if your system uses justhtml versions before 1.13.0 by running: npm list justhtml or pip show justhtml. Inspect serialized Markdown output from justhtml for improperly escaped pre content with backticks.

Impact Analysis

An attacker could exploit this to run malicious scripts in your browser when you view affected Markdown content. This could lead to theft of session cookies, account takeover, or other malicious actions depending on the context of the application using justhtml.

Compliance Impact

This XSS vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations may face compliance violations if exploited.

Mitigation Strategies

Upgrade justhtml to version 1.13.0 or later immediately. If upgrading is not possible, avoid using the to_markdown() function with sanitize=True or validate Markdown output before rendering.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-5389. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart