https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 15:58:18 +0000 https://vulnerability.circl.lu/vuln/cve-2026-8445 <p><strong>Affected:</strong> EmilStenstrom justhtml</p> <p>justhtml versions &lt;= 1.11.0 (fixed in 1.12.0) do not sufficiently escape HTML-significant characters (angle brackets) in text nodes when converting a parsed document to Markdown via to_markdown(). While a small set of Markdown metacharacters are escaped, characters such as &lt; and &gt; are preserved, so untrusted input that is safe in to_html() — including entity-decoded text (e.g. &amp;lt;script&amp;gt;) or text from RCDATA/RAWTEXT-parsed elements like &lt;title&gt;, &lt;textarea&gt;, &lt;noscript&gt;, and &lt;plaintext&gt; — can be emitted as raw HTML in the Markdown output, enabling a sanitizer bypass and potential cross-site scripting when that output is rendered.</p> <p><strong>Affected:</strong> EmilStenstrom justhtml</p> <p>justhtml versions &lt;= 1.11.0 (fixed in 1.12.0) do not sufficiently escape HTML-significant characters (angle brackets) in text nodes when converting a parsed document to Markdown via to_markdown(). While a small set of Markdown metacharacters are escaped, characters such as &lt; and &gt; are preserved, so untrusted input that is safe in to_html() — including entity-decoded text (e.g. &amp;lt;script&amp;gt;) or text from RCDATA/RAWTEXT-parsed elements like &lt;title&gt;, &lt;textarea&gt;, &lt;noscript&gt;, and &lt;plaintext&gt; — can be emitted as raw HTML in the Markdown output, enabling a sanitizer bypass and potential cross-site scripting when that output is rendered.</p> https://vulnerability.circl.lu/vuln/cve-2026-8445