CVE-2026-8445
Received Received - Intake

HTML Injection in JustHTML via Markdown Conversion

Publication date: 2026-08-23

Last updated on: 2026-08-23

Assigner: VulnCheck

Description
justhtml versions <= 1.11.0 (fixed in 1.12.0) do not sufficiently escape HTML-significant characters (angle brackets) in text nodes when converting a parsed document to Markdown via to_markdown(). While a small set of Markdown metacharacters are escaped, characters such as < and > are preserved, so untrusted input that is safe in to_html() — including entity-decoded text (e.g. &lt;script&gt;) or text from RCDATA/RAWTEXT-parsed elements like <title>, <textarea>, <noscript>, and <plaintext> — can be emitted as raw HTML in the Markdown output, enabling a sanitizer bypass and potential cross-site scripting when that output is rendered.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-23
Last Modified
2026-08-23
Generated
2026-08-23
AI Q&A
2026-08-23
EPSS Evaluated
N/A
NVD
CVE-2026-8445
EUVD
EUVD-2026-64659

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
emilstenstrom justhtml to 1.12.0 (exc)
emilstenstrom justhtml From 0 (inc) to 1.12.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-8445 is a sanitizer bypass vulnerability in the justhtml library affecting versions <= 1.11.0. The issue occurs in the to_markdown() function, which fails to escape HTML-significant characters like angle brackets (< and >) in text nodes. This allows untrusted input that is safe in to_html() to become raw HTML in Markdown output, enabling malicious content to be rendered as executable HTML.

Detection Guidance

Check if your system uses justhtml versions <= 1.11.0 by inspecting package.json or dependency files. Use commands like 'npm list justhtml' or 'pip show justhtml' to verify installed versions.

Impact Analysis

This vulnerability can lead to cross-site scripting (XSS) attacks when untrusted input is converted to Markdown and later rendered. Attackers could inject malicious scripts via entity-decoded text or content from elements like title, textarea, noscript, or plaintext, bypassing security measures and executing arbitrary code in a user's browser.

Compliance Impact

This vulnerability could lead to cross-site scripting (XSS) attacks, which may result in unauthorized data access or manipulation. For GDPR, this could violate principles of data integrity and confidentiality. For HIPAA, it might expose protected health information to unauthorized parties.

Mitigation Strategies

Upgrade justhtml to version 1.12.0 or later immediately. If upgrading is not possible, review and sanitize all inputs processed by to_markdown() to ensure HTML-significant characters are escaped before rendering.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-8445. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart