GHSA-jf6w-2mvx-633j

# justhtml: to_markdown() code-span blank-line breakout enables XSS ### Summary In `justhtml` 0.9.0 through 1.21.0, `to_markdown()` renders `<code>` text (and `<pre>` text inside a link) as an inline Markdown code span whose only protection is backtick-fence length. A blank line (`\n\n`) in that text terminates the inline span in any compliant Markdown renderer, so attacker-controlled text that survived HTML sanitization is emitted **unescaped** after the blank line and is re-parsed as live raw HTML/Markdown — yielding XSS in the default configuration. Likely **CWE-79 (Cross-site Scripting)** arising from **CWE-116 (Improper Encoding/Escaping of Output)**. ### Details `to_markdown()` is documented as a safety surface. `docs/text.md` states the guarantee applies "to the HTML produced by rendering that Markdown with a compliant Markdown renderer," and `SECURITY.md` promises `to_markdown()` "escapes line-start Markdown markers that could change block structure" and "uses code fences long enough to contain backticks safely." The inline code-span helper only sizes the backtick fence; it never accounts for block boundaries: `src/justhtml/node.py:32-41` (tag `v1.21.0`): ```python def _markdown_code_span(s: str | None) -> str: if s is None: s = "" # Use a backtick fence longer than any run of backticks inside. fence = _markdown_backtick_fence(s, minimum=1) # CommonMark requires a space if the content starts/ends with backticks. needs_space = s.startswith("`") or s.endswith("`") if needs_space: return f"{fence} {s} {fence}" return f"{fence}{s}{fence}" ``` The element's text is taken verbatim (`strip=False`, so embedded newlines are preserved) and routed into that helper: `src/justhtml/node.py:1061-1078` (tag `v1.21.0`): ```python if tag == "pre": code = current.to_text(separator="", strip=False) if current_in_link: current_builder.raw(_markdown_code_span(code