justhtml versions <= 1.11.0 (fixed in 1.12.0) do not sufficiently escape HTML-significant characters (angle brackets) in text nodes when converting a parsed document to Markdown via to_markdown(). While a small set of Markdown metacharacters are escaped, characters such as < and > are preserved, so untrusted input that is safe in to_html() — including entity-decoded text (e.g. &lt;script&gt;) or text from RCDATA/RAWTEXT-parsed elements like <title>, <textarea>, <noscript>, and <plaintext> — can be emitted as raw HTML in the Markdown output, enabling a sanitizer bypass and potential cross-site scripting when that output is rendered.

justhtml versions 1.11.0 and earlier contain a vulnerability in the to_markdown() function that fails to properly escape HTML-significant characters such as angle brackets in text nodes. This allows untrusted input that is safely handled by to_html() to be emitted as raw HTML in Markdown output. Affected sources include entity-decoded text and content from RCDATA/RAWTEXT-parsed elements like title, textarea, noscript, and plaintext. The flaw enables a sanitizer bypass where potentially malicious HTML, including script tags, can pass through unescaped. When the resulting Markdown is rendered by a downstream processor, it can lead to cross-site scripting (XSS) attacks. The vulnerability is fixed in version 1.12.0. Users are advised to upgrade immediately to mitigate the risk of XSS exploitation.