CVE-2026-77088CWE-79cross-site-scripting

CVE-2026-77088

Medium · published August 23, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
17.1
In the wild
Unconfirmed
What it is

justhtml versions 0.9.0 through 1.21.0 contain a cross-site scripting vulnerability in to_markdown() where inline code spans fail to account for blank lines as block boundaries. Attackers can inject blank lines into code or pre element text to break the inline span, causing sanitized HTML to be emitted unescaped and re-parsed as live Markdown by compliant renderers.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
EPSS
0.00263 · 17.1th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-08-23T18:16Z
References (2)
https://github.com/EmilStenstrom/justhtml/security/advisories/GHSA-jf6w-2mvx-633j · [email protected]https://www.vulncheck.com/advisories/justhtml-through-cross-site-scripting-via-code-span · [email protected]
EPSS history
Timeline
  • 23 AUG 13:34Z
    justhtml 0.9.0 through 1.21.0 Cross-Site Scripting via code-span
    cvelistv5