The vulnerability resides in the to_markdown() function of justhtml prior to version 1.13.0. When an attacker supplies content that contains a <pre> element with backticks, the function incorrectly handles the fixed‑length code fences, causing the generated Markdown to include raw HTML that later renders in CommonMark or GitHub‑Flavored‑Markdown renderers. This flaw allows an attacker to execute arbitrary scripts in the browser context of any page that renders the affected Markdown.

Individuals or organizations using justhtml 1.12.9 or earlier are exposed. The product is a markdown renderer library for Go, commonly embedded in web applications that render user‑supplied content. No other vendors or product versions are listed as affected.

The CVSS score is 5.1, indicating a moderate severity. EPSS is not available, so current exploitation probability cannot be assessed from that metric. The vulnerability is not listed in CISA's KEV catalog. Exploitation would require that an attacker can provide controlled content that passes through the to_markdown() routine and is subsequently rendered by a CommonMark or GitHub‑Flavored‑Markdown parser. In many environments, this could be achieved with a user profile page, comment box, or any feature that renders Markdown. Because the flaw is client‑side, the impact is limited to the victim’s browser, but it can still be used for phishing or session hijacking. The attack surface is therefore moderate, and remediation is strongly recommended.