CyberRota Analysis
AI-GeneratedVersions 0.9.0 through 1.21.0 of justhtml are vulnerable to a cross-site scripting (XSS) flaw in the to_markdown() function, which mishandles blank lines in inline code spans. This vulnerability allows attackers to inject malicious content, leading to the potential execution of unescaped HTML as live Markdown in compliant renderers. Developers and organizations using affected versions should prioritize patching this vulnerability to mitigate the risk of XSS attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
justhtml versions 0.9.0 through 1.21.0 contain a cross-site scripting vulnerability in to_markdown() where inline code spans fail to account for blank lines as block boundaries. Attackers can inject blank lines into code or pre element text to break the inline span, causing sanitized HTML to be emitted unescaped and re-parsed as live Markdown by compliant renderers.