justhtml EUVD-2026-64653

Exploitation requires three chained conditions: (1) the application passes attacker-controlled HTML that includes <pre> elements to JustHTML(..., sanitize=True).to_markdown() - applications that only call to_html() are unaffected; (2) the attacker can embed a backtick run of three or more characters and HTML-entity-encoded tags inside the <pre> element; and (3) the resulting Markdown output is rendered by a CommonMark- or GFM-compatible renderer that permits raw HTML passthrough (e.g., GitHub Flavored Markdown in permissive mode, marked.js with sanitize: false). What limits exploitation: the CVSS UI:A metric confirms a victim must actively render the Markdown; renderers configured to strip raw HTML block the payload at the final step; and only the <pre> serialization path is affected - regular text node content was already hardened in v1.12.0.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N, score 5.1) accurately reflects the multi-hop nature of this vulnerability: impact is limited to the subsequent system (browser/renderer) and requires active user interaction to render the crafted Markdown. No EPSS data is available, and the vulnerability is not listed in CISA KEV, indicating no confirmed widespread active exploitation. However, a detailed PoC with working Python code is embedded in the public GHSA advisory, lowering the bar for exploitation. The realistic risk is constrained to applications that (1) accept attacker-controlled HTML containing <pre> elements, (2) call to_markdown() on that input, and (3) feed the result to a raw-HTML-permitting Markdown renderer. Applications using only to_html() are unaffected. This is a medium-priority finding for affected deployment patterns - real risk exists but only within a specific pipeline.

An attacker submits a comment or document containing <pre>&#96;&#96;&#96; &lt;img src=x onerror=alert(document.cookie)&gt;</pre> to an application that processes user HTML through JustHTML(..., sanitize=True).to_markdown() and then displays the result in a web page via a CommonMark renderer. The fixed ` delimiter is broken by the backtick run, placing the decoded <img> tag outside the code fence; when a victim views the page, the onerror handler fires and the attacker's script executes. The PoC in the GHSA advisory demonstrates this end-to-end.