justhtml to_markdown() HTML Escaping Bypass (Sanitizer Bypass / XSS)

Technical Analysis

CVE-2026-8445 (CVSS 9.8) stems from incomplete output encoding in justhtml's to_markdown() function: while common Markdown metacharacters are escaped, HTML-significant characters '<' and '>' are left untouched. This allows attacker-controlled text — including entity-decoded payloads like &lt;script&gt; or content parsed from RCDATA/RAWTEXT contexts such as <title>, <textarea>, <noscript>, and <plaintext> — to pass through as literal HTML tags in the generated Markdown, defeating the assumption that to_markdown() output is safe for downstream rendering. Applications that treat Markdown output as a sanitized intermediate format and later render it to HTML (e.g., documentation generators, chat renderers, CMS pipelines) are exposed to stored/reflected XSS. This is particularly relevant to AI agent and RAG systems that use justhtml to convert scraped or ingested web content into Markdown for LLM context windows or for rendering agent-generated summaries in web UIs — an attacker could poison ingested content so that downstream rendering of agent output executes malicious scripts in an operator's or user's browser, potentially leading to session/token theft or further compromise of the agent's operating environment.

Affected Systems

justhtml npm/PyPI (or equivalent) package versions <= 1.11.0; any application, service, or AI agent/RAG pipeline that uses justhtml's to_markdown() function to convert untrusted or user-supplied HTML into Markdown for storage, LLM ingestion, or later HTML rendering.

Indicators of Compromise

• Package: justhtml (versions <= 1.11.0)
• Fixed version: justhtml 1.12.0
• No known public exploit hashes/domains at time of disclosure

Remediation Steps

1. 1

   Upgrade justhtml

   Update justhtml to version 1.12.0 or later, which properly escapes angle brackets in to_markdown() output.

2. 2

   Audit dependency usage

   Identify all services, agent pipelines, and RAG ingestion tools that depend on justhtml (directly or transitively) and prioritize patching those exposed to untrusted HTML input.

3. 3

   Sanitize downstream rendering

   Apply an independent HTML sanitizer (e.g., DOMPurify) to any Markdown-to-HTML rendering step, rather than relying solely on justhtml's output being safe.

4. 4

   Review agent/RAG ingestion pipelines

   For AI agent systems that scrape or ingest external HTML and convert it to Markdown for LLM context or UI display, treat the converted output as untrusted and re-validate before rendering or feeding into prompts that may be reflected back to users.

5. 5

   Monitor for exploitation

   Review logs and rendered outputs for injected script tags or unexpected HTML in Markdown-rendered content, especially in user-facing dashboards or chat interfaces.