CVE-2026-5389

This CVE exposes a dangerous assumption that lives quietly in most content pipelines: sanitized HTML remains safe after Markdown serialization. It doesn't. The justhtml library converts sanitized HTML to Markdown using fixed-length code fences, and the gap between these two security models is where the vulnerability lives. The core mechanism is backtick injection into code fences. The sanitizer strips dangerous HTML attributes and tags. The Markdown generator wraps content in triple-backtick fences of a deterministic length—say, three backticks. An attacker who controls the input can probe that fence length and inject backticks to break out of the fence entirely, causing the renderer to interpret arbitrary content as Markdown and execute the payload. This isn't a bug in either component working correctly in isolation; it's a failure at the seam between them. What makes this a class vulnerability rather than a one-off is that the 'fixed-length fence for simplicity' pattern has appeared repeatedly in template engines, JSON serializers, and cookie encoders. The security literature documented this exact attack surface in 2019—backtick injection against GFM code fences—and yet the pattern keeps emerging because developers reach for fixed delimiters as a performance heuristic without seeing the downstream composition that makes them dangerous. For defenders: audit any library in your content pipeline that performs format conversion and check whether it uses fixed-length delimiters for fences, delimiters, or escapes. If it does, treat that boundary as security-sensitive and add explicit escaping at render time, regardless of what the upstream sanitizer promised. The assumption that 'sanitized input stays safe through transformation' is the detonator for this entire class of vulnerability—and it's an assumption your codebase may be making without realizing it.

Reviewed through automated stages and approved by a human before publication.