CVE-2026-77088: medium-severity vulnerability in EmilStenstrom justhtml
justhtml 0.9.0 through 1.21.0 Cross-Site Scripting via code-span
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.3%
justhtml versions 0.9.0 through 1.21.0 contain a cross-site scripting vulnerability in to_markdown() where inline code spans fail to account for blank lines as block boundaries. Attackers can inject blank lines into code or pre element text to break the inline span, causing sanitized HTML to be emitted unescaped and re-parsed as live Markdown by compliant renderers.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Affected products
EmilStenstrom · justhtmlRelated CVEs — EmilStenstrom justhtml
In the same product, most dangerous first.
CVE-2026-4671HIGHjusthtml before 1.18.0 Denial of Service via CSS SelectorEPSS 0.7%CVE-2026-8445CRITICALjusthtml before 1.12.0 Sanitizer Bypass via MarkdownEPSS 0.6%CVE-2026-7808CRITICALjusthtml before 1.16.0 Multiple Security Issues via SanitizationEPSS 0.6%CVE-2026-5388CRITICALjusthtml before 1.15.0 Multiple Security IssuesEPSS 0.6%CVE-2026-9769HIGHjusthtml before 1.10.0 Denial of Service via deeply nested HTMLEPSS 0.3%CVE-2026-8630MEDIUMjusthtml before 1.12.0 Mutation XSS via Raw Text ElementsEPSS 0.3%