p PatchFirst

CVE-2026-8445

CVE-2026-8445 · justhtml before 1.12.0 Sanitizer Bypass via Markdown

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

justhtml versions <= 1.11.0 (fixed in 1.12.0) do not sufficiently escape HTML-significant characters (angle brackets) in text nodes when converting a parsed document to Markdown via to_markdown(). While a small set of Markdown metacharacters are escaped, characters such as < and > are preserved, so untrusted input that is safe in to_html() — including entity-decoded text (e.g. &lt;script&gt;) or text from RCDATA/RAWTEXT-parsed elements like <title>, <textarea>, <noscript>, and <plaintext> — can be emitted as raw HTML in the Markdown output, enabling a sanitizer bypass and potential cross-site scripting when that output is rendered.

CVSS 9.3 · Crítica · EPSS 0,6% · Corrección disponible

Publicación
Actualización

Pila tecnológica: python

Productos y versiones afectados

  • justhtml

    Versiones
    • ≥ 0, < 1.12.0: Afectada (semver)
    • 1.12.0: No afectada (semver)

    Actualiza a 1.12.0

  • justhtml PyPI

    Versiones
    • 0.1.0
    • 0.10.0
    • 0.11.0
    • 0.12.0
    • 0.13.0
    • 0.13.1
    • 0.14.0
    • 0.15.0
    • 0.16.0
    • 0.17.0
    • 0.18.0
    • 0.19.0
    • 0.2.0
    • 0.20.0
    • 0.21.0
    • 0.22.0
    • 0.23.0
    • 0.24.0
    • 0.25.0
    • 0.26.0
    • 0.27.0
    • 0.28.0
    • 0.29.0
    • 0.3.0
    • 0.30.0
    • 0.31.0
    • 0.32.0
    • 0.33.0
    • 0.34.0
    • 0.35.0
    • 0.36.0
    • 0.37.0
    • 0.38.0
    • 0.39.0
    • 0.4.0
    • 0.40.0
    • 0.5.0
    • 0.5.1
    • 0.5.2
    • 0.6.0
    • 0.7.0
    • 0.8.0
    • 0.9.0
    • 1.0.0
    • 1.1.0
    • 1.10.0
    • 1.11.0
    • 1.2.0
    • 1.3.0
    • 1.4.0
    • 1.5.0
    • 1.6.0
    • 1.7.0
    • 1.8.0
    • 1.9.0
    • 1.9.1
    Intervalos de versiones afectados
    • ECOSYSTEM: < 1.12.0

    Actualiza a 1.12.0

Fuentes originales

Comprueba tu servidor →