CVE-2026-8445: Improper Neutralization of Input During Web Page Generation

justhtml versions are preserved, so untrusted input that is safe in tohtml — including entity-decoded text e.g. or text from RCDATA/RAWTEXT-parsed elements like , , , and — can be emitted as raw HTML in the Markdown output, enabling a sanitizer bypass and potential cross-site scripting when that...