CVE-2026-77088
Received Received - Intake

XSS in justhtml via Malformed Markdown Processing

Publication date: 2026-08-23

Last updated on: 2026-08-23

Assigner: VulnCheck

Description
justhtml versions 0.9.0 through 1.21.0 contain a cross-site scripting vulnerability in to_markdown() where inline code spans fail to account for blank lines as block boundaries. Attackers can inject blank lines into code or pre element text to break the inline span, causing sanitized HTML to be emitted unescaped and re-parsed as live Markdown by compliant renderers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-23
Last Modified
2026-08-23
Generated
2026-08-23
AI Q&A
2026-08-23
EPSS Evaluated
N/A
NVD
CVE-2026-77088
EUVD
EUVD-2026-64657

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
justhtml justhtml From 0.9.0 (inc) to 1.21.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a cross-site scripting (XSS) vulnerability in the justhtml library versions 0.9.0 through 1.21.0. It occurs in the to_markdown() function where inline code spans fail to recognize blank lines as block boundaries. Attackers can inject blank lines into code or pre elements, breaking the inline span and causing sanitized HTML to be emitted unescaped. This unescaped HTML is then re-parsed as live Markdown by compliant renderers, enabling XSS attacks.

Detection Guidance

To detect this vulnerability, inspect applications using justhtml versions 0.9.0 through 1.21.0. Check if the to_markdown() function processes inline code spans with potential blank line injections. Review HTML output for unescaped Markdown or script tags. Use static analysis tools to scan for improper handling of code spans in user-supplied input.

Impact Analysis

If you use justhtml versions 0.9.0 through 1.21.0 and call to_markdown() on untrusted HTML, attackers could inject malicious scripts via blank lines in code or pre elements. These scripts may execute in users' browsers, potentially stealing data, session cookies, or performing actions on their behalf.

Compliance Impact

This XSS vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Organizations using affected versions may face compliance failures, legal liabilities, and reputational damage if exploited.

Mitigation Strategies

Immediately upgrade justhtml to a patched version beyond 1.21.0. If upgrading is not possible, disable the to_markdown() function or sanitize user input before processing. Ensure all HTML output is properly escaped and use a Markdown renderer that enforces strict boundaries for code spans. Monitor for suspicious activity in rendered content.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77088. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart