The vulnerability in justhtml (CVE-2026-8445) arises because the to_markdown() function does not sufficiently escape angle brackets (< and >) in text nodes when converting parsed HTML to Markdown. While some Markdown metacharacters are escaped, these critical characters remain, allowing entity-decoded input or text from RCDATA/RAWTEXT elements like <title>, <textarea>, <noscript>, and <plaintext> to be emitted as raw HTML. This can lead to sanitizer bypass and cross-site scripting when the Markdown output is rendered. The flaw affects justhtml versions up to 1.11.0 and is fixed in 1.12.0.

An attacker can inject malicious HTML or script code into Markdown output generated by justhtml, potentially leading to cross-site scripting attacks when the Markdown is rendered. This can compromise confidentiality, integrity, and availability of affected systems or user data. The CVSS 4.0 score is 9.3 (critical), indicating high impact with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

A fix is available in justhtml version 1.12.0. Users should upgrade to version 1.12.0 or later to remediate this vulnerability. No other official remediation guidance is provided. Patch status is confirmed by the version fix information.