CVE Feed

    Dashboard / CVE / CVE-2026-5389

    CVE-2026-5389

    justhtml versions before 1.13.0 contain a cross-site scripting vulnerability in the to_markdown() function when serializing attacker-controlled pre content. Attackers can place backticks inside sanitized pre elements to break out of fixed-length code fences, allowing raw HTML to execute when the generated Markdown is rendered by CommonMark or GFM-style renderers.

    Published:Aug 23, 2026
    Last Modified:Aug 24, 2026
    EPS:Aug 23, 2026
    EPSS Score:0.00188
    CVSS Score:6.1

    Affected Products

    Vendor
    Emilstenstrom
    Product
    Justhtml

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-9769 (CVSS 8.7) — justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial of service.…
    CVE-2026-8630 (CVSS 5.1) — justhtml before 1.12.0 (versions <= 1.11.0) contains a mutation cross-site scripting (mXSS) vulnerability in t…
    CVE-2026-8445 (CVSS 9.3) — justhtml versions <= 1.11.0 (fixed in 1.12.0) do not sufficiently escape HTML-significant characters (angle br…
    CVE-2026-7808 (CVSS 9.3) — justhtml before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active/dangerous conte…
    CVE-2026-77088 (CVSS 5.3) — justhtml versions 0.9.0 through 1.21.0 contain a cross-site scripting vulnerability in to_markdown() where inl…
    CVE-2026-74793 (CVSS 5.1) — justhtml before 3.11.0 contains a cross-site scripting vulnerability where the default sanitizer bypasses even…
    CVE-2026-6827 (CVSS 5.1) — justhtml before 1.17.0 contains multiple security issues in sanitization, serialization, and programmatic DOM …
    CVE-2026-5751 (CVSS 5.1) — justhtml versions 1.13.0 and earlier contain a parser-differential / mutation cross-site scripting (mXSS) vuln…
    CVE-2026-5388 (CVSS 9.3) — justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers (clean_url_value/clean_ur…
    CVE-2026-4671 (CVSS 8.7) — justhtml before 1.18.0 contains multiple low-severity denial-of-service issues in CSS selector handling and li…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High