A critical vulnerability in the EmilStenstrom justhtml library enables cross-site scripting by failing to properly escape HTML characters during the conversion of documents to Markdown.

This is an improper neutralization of input issue (CWE-79) where HTML-significant characters are not correctly escaped during the to_markdown() transformation. This allows untrusted input to be emitted as raw HTML, which may be executed when the resulting Markdown is rendered.

With a CVSS score of 9.8, this vulnerability poses a significant risk to applications that process and render user-generated content as Markdown. Successful exploitation can lead to unauthorized script execution, facilitating account takeovers and the exposure of sensitive user data.

Immediate Action: Update the PyPI package justhtml to version 1.12.0 or higher.

Proactive Monitoring: Monitor application environments for the presence of unexpected HTML tags within rendered Markdown content.

Compensating Controls: Utilize a secondary output sanitizer on the rendered Markdown to ensure that no raw HTML tags remain before the content is displayed in the browser.

Public Exploit Available: Unknown.

Developers should immediately upgrade to version 1.12.0 or later of the justhtml library. It is essential to review any application logic that converts parsed HTML to Markdown to ensure that the updated library functions are correctly implemented and that no residual injection vectors remain.