Cloudanix VulnDB

GHSA-3rcm-vjrc-p45j

Medium · 5.4

JustHTML has a Sanitizer Bypass (in Markdown)

CVSS

5.4

EPSS

—

Published

Mar 18, 2026

CISA due date

—

The record

`to_markdown()` does not sufficiently escape text content that looks like HTML. As a result, untrusted input that is safe in `to_html()` can become raw HTML in Markdown output. This is not specific to tokenizer raw-text states like `<title>`, `<noscript>`, or `<plaintext>`, although those states can trigger the behavior. The root cause is broader: Markdown text serialization leaves angle brackets unescaped in text nodes.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities