JustHTML is vulnerable to XSS via code fence breakout in <pre> content
Date: 2026-03
Affected: pip/justhtml
Attack vector: xss
Category: vulnerability-disclosure
Severity: High
CWE: CWE-79
CWE-80

## Summary `to_markdown()` is vulnerable when serializing attacker-controlled `<pre>` content. The `<pre>` handler emits a fixed three-backtick fenced code block, but writes decoded text content into that fence without choosing a delimiter longer than any backtick run inside the content. An attacker can place backticks and HTML-like text inside a sanitized `<pre>` element so that the generated Markdown closes the fence early and leaves raw HTML outside the code block. When that Markdown is rendered by a CommonMark/GFM-style renderer that allows raw HTML, the HTML executes. This is a bypass of the v1.12.0 Markdown hardening. That fix escaped HTML-significant characters for regular text nodes, but `<pre>` uses a separate serialization path and does not apply the same protection. ## Details The vulnerable `<pre>` Markdown path: - extracts decoded text from the `<pre>` subtree - opens a fenced block with a fixed delimiter of `````` - writes the decoded text directly into the output - closes with another fixed `````` Because the fence length is fixed, attacker-controlled content containing a backtick run of length 3 or more can terminate the code block. If the content also contains decoded HTML-like text such as `&lt;img ...&gt;`, that text appears outside the fence in the resulting Markdown and is treated as raw HTML by downstream Markdown renderers. The issue is not that HTML-like text appears inside code blocks. The issue is that the serializer allows attacker-controlle


Mitigations:

Architectural layers (MAESTRO):