Cloudanix VulnDB

GHSA-5vp3-3cg6-2rq3

Medium · 6.5

JustHTML is vulnerable to XSS via code fence breakout in <pre> content

CVSS

6.5

EPSS

—

Published

Mar 24, 2026

CISA due date

—

The record

`to_markdown()` is vulnerable when serializing attacker-controlled `<pre>` content. The `<pre>` handler emits a fixed three-backtick fenced code block, but writes decoded text content into that fence without choosing a delimiter longer than any backtick run inside the content. An attacker can place backticks and HTML-like text inside a sanitized `<pre>` element so that the generated Markdown closes the fence early and leaves raw HTML outside the code block. When that Markdown is rendered by a CommonMark/GFM-style renderer that allows raw HTML, the HTML executes. This is a bypass of the v1.12.0 Markdown hardening. That fix escaped HTML-significant characters for regular text nodes, but `<pre>` uses a separate serialization path and does not apply the same protection.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities