justhtml before 1.13.0 XSS via code fence breakout
Priority MEDIUM 56CWE-80Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- None · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-80.
Summary
justhtml versions before 1.13.0 contain a cross-site scripting vulnerability in the to_markdown() function when serializing attacker-controlled pre content. Attackers can place backticks inside sanitized pre elements to break out of fixed-length code fences, allowing raw HTML to execute when the generated Markdown is rendered by CommonMark or GFM-style renderers.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0023 13th percentileScored 2026-11-07
Fix Fixed justhtml (EmilStenstrom): 1.13.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| EmilStenstrom | justhtml | before 1.13.0 | 1.13.0 | Patch available | CNA |
- justhtml VendorEmilStenstrom Affected before 1.13.0 Fixed in 1.13.0 Patch available CNA
Remediation
- Fix · CNA justhtml (EmilStenstrom) Fixed in 1.13.0
Timeline
- 2026-10-02 Threatist record created from CVE-2026-5389
- 2026-10-03 Alias added: GHSA-q3jf-9wv7-p29w
References
More EmilStenstrom vulnerabilities
- TI-2026-07422 justhtml before 1.12.0 Sanitizer Bypass via Markdown CVSS 4.0CRITICAL 9.3
- TI-2026-08560 justhtml before 1.10.0 Denial of Service via deeply nested HTML CVSS 4.0HIGH 8.7
- TI-2026-52557 justhtml before 3.11.0 XSS via selectedcontent projection CVSS 4.0MEDIUM 5.1
- TI-2026-06871 justhtml before 1.16.0 Multiple Security Issues via Sanitization CVSS 4.0CRITICAL 9.3
- TI-2026-04716 justhtml before 1.15.0 Multiple Security Issues CVSS 4.0CRITICAL 9.3
- TI-2026-04066 justhtml before 1.18.0 Denial of Service via CSS Selector CVSS 4.0HIGH 8.7
Sources
- CVE-2026-5389 · CVE Program
- CVE-2026-5389 · NVD
- FIRST EPSS
- GHSA-q3jf-9wv7-p29w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences