CVE Feed

    Dashboard / CVE / CVE-2026-77088

    CVE-2026-77088

    justhtml versions 0.9.0 through 1.21.0 contain a cross-site scripting vulnerability in to_markdown() where inline code spans fail to account for blank lines as block boundaries. Attackers can inject blank lines into code or pre element text to break the inline span, causing sanitized HTML to be emitted unescaped and re-parsed as live Markdown by compliant renderers.

    Published:Aug 23, 2026
    Last Modified:Aug 26, 2026
    EPS:Aug 23, 2026
    EPSS Score:0.00188
    CVSS Score:6.1

    Affected Products

    Vendor
    Emilstenstrom
    Product
    Justhtml

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-9769 (CVSS 8.7) — justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial of service.…
    CVE-2026-8630 (CVSS 5.1) — justhtml before 1.12.0 (versions <= 1.11.0) contains a mutation cross-site scripting (mXSS) vulnerability in t…
    CVE-2026-8445 (CVSS 9.3) — justhtml versions <= 1.11.0 (fixed in 1.12.0) do not sufficiently escape HTML-significant characters (angle br…
    CVE-2026-7808 (CVSS 9.3) — justhtml before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active/dangerous conte…
    CVE-2026-74793 (CVSS 5.1) — justhtml before 3.11.0 contains a cross-site scripting vulnerability where the default sanitizer bypasses even…
    CVE-2026-6827 (CVSS 5.1) — justhtml before 1.17.0 contains multiple security issues in sanitization, serialization, and programmatic DOM …
    CVE-2026-5751 (CVSS 5.1) — justhtml versions 1.13.0 and earlier contain a parser-differential / mutation cross-site scripting (mXSS) vuln…
    CVE-2026-5389 (CVSS 5.1) — justhtml versions before 1.13.0 contain a cross-site scripting vulnerability in the to_markdown() function whe…
    CVE-2026-5388 (CVSS 9.3) — justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers (clean_url_value/clean_ur…
    CVE-2026-4671 (CVSS 8.7) — justhtml before 1.18.0 contains multiple low-severity denial-of-service issues in CSS selector handling and li…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High