Search for vulnerabilities
| Vulnerability ID | VCID-vjy5-thkw-1kaq |
| Aliases |
GHSA-3rcm-vjrc-p45j
|
| Summary | JustHTML has a Sanitizer Bypass (in Markdown) ## Summary `to_markdown()` does not sufficiently escape text content that looks like HTML. As a result, untrusted input that is safe in `to_html()` can become raw HTML in Markdown output. This is not specific to tokenizer raw-text states like `<title>`, `<noscript>`, or `<plaintext>`, although those states can trigger the behavior. The root cause is broader: Markdown text serialization leaves angle brackets unescaped in text nodes. ## Details When converting a parsed document to Markdown, text nodes are escaped for a small set of Markdown metacharacters, but HTML-significant characters such as `<` and `>` are preserved. That means content parsed as text, including entity-decoded text or text produced by RCDATA/RAWTEXT-style parsing, can be emitted into Markdown as raw HTML. Examples of affected input include: - Text produced from entity-decoded input such as `<script>...</script>` - Text inside elements like `<title>`, `<textarea>`, `<noscript>` (when parsed as raw text), and `<plaintext>` This is distinct from actual `<script>` or `<style>` elements in the DOM. Those are already dropped by default in `to_markdown()` unless `html_passthrough=True`. ## Proof of Concept ### General case ```python from justhtml import JustHTML doc = JustHTML("<p><img src=x onerror=alert(1)></p>", fragment=True) print(doc.to_html()) print() print(doc.to_markdown()) |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 6.2 |
| Risk | 3.1 |
| Affected and Fixed Packages | Package Details |
| System | Score | Found at |
|---|---|---|
| cvssv3.1_qr | MODERATE | https://github.com/advisories/GHSA-3rcm-vjrc-p45j |
| cvssv4 | 5.3 | https://github.com/EmilStenstrom/justhtml |
| generic_textual | MODERATE | https://github.com/EmilStenstrom/justhtml |
| cvssv3.1_qr | MODERATE | https://github.com/EmilStenstrom/justhtml/security/advisories/GHSA-3rcm-vjrc-p45j |
| cvssv4 | 5.3 | https://github.com/EmilStenstrom/justhtml/security/advisories/GHSA-3rcm-vjrc-p45j |
| generic_textual | MODERATE | https://github.com/EmilStenstrom/justhtml/security/advisories/GHSA-3rcm-vjrc-p45j |
| Reference id | Reference type | URL |
|---|---|---|
| https://github.com/EmilStenstrom/justhtml | ||
| https://github.com/EmilStenstrom/justhtml/security/advisories/GHSA-3rcm-vjrc-p45j | ||
| GHSA-3rcm-vjrc-p45j | https://github.com/advisories/GHSA-3rcm-vjrc-p45j |
| Attack Vector (AV) | Attack Complexity (AC) | Attack Requirements (AT) | Privileges Required (PR) | User Interaction (UI) | Vulnerable System Impact Confidentiality (VC) | Vulnerable System Impact Integrity (VI) | Vulnerable System Impact Availability (VA) | Subsequent System Impact Confidentiality (SC) | Subsequent System Impact Integrity (SI) | Subsequent System Impact Availability (SA) |
|---|---|---|---|---|---|---|---|---|---|---|
network adjacent local physical |
low high |
none present |
none low high |
none passive active |
high low none |
high low none |
high low none |
high low none |
high low none |
high low none |
| Attack Vector (AV) | Attack Complexity (AC) | Attack Requirements (AT) | Privileges Required (PR) | User Interaction (UI) | Vulnerable System Impact Confidentiality (VC) | Vulnerable System Impact Integrity (VI) | Vulnerable System Impact Availability (VA) | Subsequent System Impact Confidentiality (SC) | Subsequent System Impact Integrity (SI) | Subsequent System Impact Availability (SA) |
|---|---|---|---|---|---|---|---|---|---|---|
network adjacent local physical |
low high |
none present |
none low high |
none passive active |
high low none |
high low none |
high low none |
high low none |
high low none |
high low none |
No EPSS data available for this vulnerability.
| Date | Actor | Action | Source | VulnerableCode Version |
|---|---|---|---|---|
| 2026-06-12T07:49:07.456506+00:00 | GithubOSV Importer | Import | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-3rcm-vjrc-p45j/GHSA-3rcm-vjrc-p45j.json | 38.6.0 |