The vulnerability in EmilStenstrom justhtml affects versions prior to 1.13.0. It is a basic cross-site scripting (XSS) flaw in the to_markdown() function. Specifically, when serializing pre elements controlled by an attacker, the presence of backticks can break out of the intended fixed-length code fences. This allows raw HTML to be executed upon rendering the generated Markdown with CommonMark or GitHub Flavored Markdown (GFM) style renderers. The CVSS 4.0 base score is 5.1, indicating a medium severity issue with network attack vector, low attack complexity, no privileges required, and user interaction needed.

An attacker can inject malicious HTML code that executes in the context of users rendering the affected Markdown output. This can lead to typical XSS impacts such as session hijacking, content manipulation, or other client-side attacks. However, exploitation requires user interaction and no elevated privileges are needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch link is provided at this time. Users should monitor the EmilStenstrom justhtml project for updates and apply any official patches when available. Until then, avoid processing untrusted input with the vulnerable to_markdown() function or apply custom sanitization to prevent backtick injection within pre elements.