CVE-2026-77088: justhtml 0.9.0 through 1.21.0 Cross-Site Scripting via code-span
justhtml versions 0.9.0 through 1.21.0 contain a cross-site scripting vulnerability in tomarkdown() where inline code spans fail to account for blank lines as block boundaries. Attackers can inject blank lines into code or pre element text to break the inline span, causing sanitized HTML to be emitted unescaped and re-parsed as live Markdown by compliant renderers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
justhtmlto a version that resolves this vulnerability.Fixed in 1.21.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using justhtml versions 0.9.0 through 1.21.0 are exposed when they call to_markdown() on attacker-controlled or otherwise untrusted HTML and the resulting Markdown is rendered by a compliant renderer.
What does an attacker need to exploit it?
An attacker needs to be able to place blank lines within text in code or pre elements that will be processed by to_markdown(). The malformed inline code span can then cause sanitized HTML to be emitted unescaped and interpreted as live Markdown.
How can I determine whether my application is affected?
Check whether your application uses a justhtml version from 0.9.0 through 1.21.0 and converts HTML to Markdown with to_markdown(). Risk is present if untrusted input can reach code or pre element text and the generated Markdown is subsequently rendered.