CyberRota Analysis
AI-GeneratedVersions of justhtml prior to 1.13.0 are vulnerable to a cross-site scripting (XSS) flaw in the to_markdown() function, which allows attackers to inject raw HTML by manipulating sanitized pre elements. This vulnerability can lead to the execution of malicious scripts when the generated Markdown is rendered, posing a risk to users interacting with affected content. Organizations utilizing justhtml should prioritize updating to version 1.13.0 or later to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
justhtml versions before 1.13.0 contain a cross-site scripting vulnerability in the to_markdown() function when serializing attacker-controlled pre content. Attackers can place backticks inside sanitized pre elements to break out of fixed-length code fences, allowing raw HTML to execute when the generated Markdown is rendered by CommonMark or GFM-style renderers.