justhtml CVE-2026-77088

Exploitation requires three co-occurring conditions. First, the target application must invoke justhtml's to_markdown() on HTML that includes attacker-controlled text inside code or pre elements - this function must sit on a security-relevant code path (i.e., it is being used to sanitize or safe-render user content). Second, the resulting Markdown output must be rendered by a CommonMark-compliant or similarly spec-adherent Markdown renderer in a browser context where JavaScript can execute; plain-text display of the Markdown source is not exploitable. Third, the attacker must be able to inject a blank line (\n\n) into the code or pre element's text content before it reaches to_markdown(). Exploitation is limited by UI:P (victim must view the rendered page) and by the requirement that to_markdown() output reaches a live renderer - applications that store Markdown for later non-browser consumption are not affected. PR:N in the CVSS 4.0 vector indicates no privileges are needed on the target system for the injection step.

The CVSS 4.0 score of 5.3 (Medium) is reasonably calibrated for this vulnerability. The UI:P metric correctly captures that exploitation requires a victim to view rendered Markdown output - there is no server-side code execution path. The VC:L/VI:L impact ratings reflect XSS-class outcomes (session token theft, DOM manipulation) rather than full system compromise. Real-world risk is gated by several co-occurring conditions: the application must use to_markdown() as a sanitization step, the output must be rendered by a compliant Markdown renderer in a browser context, and the attacker must be able to inject blank lines into code or pre element text that passes through the pipeline. No CISA KEV listing and no confirmed public exploit code limit the urgency for most operators; however, the scope-change nature of XSS (affecting the victim's browser session independently of the server) means that even smaller deployments relying on justhtml for content sanitization should treat upgrading to 1.22.0 as a priority rather than deferring it. EPSS data was not provided in the intelligence sources.

An attacker submits user-controlled content containing a code element whose text includes a blank line - for example, <code>safe content\n\njavascript:alert(document.cookie)</code> - to an application that pipes HTML through justhtml's to_markdown() before storing or displaying it. When a victim views the resulting Markdown rendered by a compliant renderer (e.g., CommonMark), the blank line breaks the inline code span, and the attacker's trailing payload is interpreted as live Markdown or raw HTML, executing JavaScript in the victim's browser. No public proof-of-concept code has been confirmed in the available intelligence sources.