CVE-2026-77088Medium· 6.1▾ Sunlitjusthtml versions 0.9.0 through 1.21.0 contain a cross-site scripting vulnerability in to_markdown() where inline code spans fail to account for blank lines as block boundaries. Attackers can inject blank lines into code or pre element t…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 33.6 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 24.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
0.2% → 0.3%
Last analysed / modified upstream
justhtml versions 0.9.0 through 1.21.0 contain a cross-site scripting vulnerability in to_markdown() where inline code spans fail to account for blank lines as block boundaries. Attackers can inject blank lines into code or pre element text to break the inline span, causing sanitized HTML to be emitted unescaped and re-parsed as live Markdown by compliant renderers.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
justhtml >= 0.9.0, < 1.22.0Patched in:
justhtml 1.22.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-6827Medium· 6.1justhtml before 1.17.0 contains multiple security issues in sanitization, serialization, and programmatic DOM handling
CVE-2026-5751Medium· 6.1justhtml versions 1.13.0 and earlier contain a parser-differential / mutation cross-site scripting (mXSS) vulnerability when using a custom SanitizationPolicy that preserves foreign namespaces (e.g., drop_foreign_namespaces=False with al…
CVE-2026-8445Critical· 9.8justhtml versions <= 1.11.0 (fixed in 1.12.0) do not sufficiently escape HTML-significant characters (angle brackets) in text nodes when converting a parsed document to Markdown via to_markdown()
GHSA-jf6w-2mvx-633jMedium· 6.1justhtml: to_markdown() code-span blank-line breakout enables XSS
CVE-2026-9769High· 7.5justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial of service
CVE-2026-4671High· 7.5justhtml before 1.18.0 contains multiple low-severity denial-of-service issues in CSS selector handling and linkification