Skip to main content

justhtml EUVDEUVD-2026-64657

| CVE-2026-77088 MEDIUM
Cross-site Scripting (XSS) (CWE-79)
2026-08-23 VulnCheck GHSA-3r4x-v5v7-fm2r
XSS Justhtml
5.3
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
5.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.1 MEDIUM

Network delivery, trivial blank-line injection (AC:L), no privileges needed, but scope changes to victim browser (S:C) with limited XSS impact; user must view rendered output (UI:R).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

2
Source Code Evidence Fetched
Aug 23, 2026 - 14:20 vuln.today
Analysis Generated
Aug 23, 2026 - 14:20 vuln.today

DescriptionCVE.org

justhtml versions 0.9.0 through 1.21.0 contain a cross-site scripting vulnerability in to_markdown() where inline code spans fail to account for blank lines as block boundaries. Attackers can inject blank lines into code or pre element text to break the inline span, causing sanitized HTML to be emitted unescaped and re-parsed as live Markdown by compliant renderers.

AnalysisAI

Cross-site scripting in justhtml 0.9.0-1.21.0 allows an attacker who can control the text content of HTML code or pre elements to escape the Markdown inline code span produced by to_markdown(), causing sanitized content to be emitted unescaped and re-parsed as live HTML by a downstream Markdown renderer. The to_markdown() function is explicitly documented as a security boundary, making this a trust-model violation. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Inject blank line into code/pre element text
Delivery
Submit crafted HTML to application
Exploit
to_markdown() emits unescaped content after broken span
Execution
Markdown renderer parses payload as live HTML
Impact
XSS executes in victim browser session
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires three co-occurring conditions. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 5.3 (Medium) is reasonably calibrated for this vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker submits user-controlled content containing a code element whose text includes a blank line - for example, <code>safe content\n\njavascript:alert(document.cookie)</code> - to an application that pipes HTML through justhtml's to_markdown() before storing or displaying it. When a victim views the resulting Markdown rendered by a compliant renderer (e.g., CommonMark), the blank line breaks the inline code span, and the attacker's trailing payload is interpreted as live Markdown or raw HTML, executing JavaScript in the victim's browser. …
Remediation Upgrade justhtml to version 1.22.0, which is confirmed as the fixed release per the GHSA-jf6w-2mvx-633j advisory and EUVD-2026-64657 data (fixed in: 1.22.0). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Justhtml

View all
CVE-2026-9769 HIGH POC
8.7 Aug 23

Uncontrolled recursion in the justhtml Python HTML parsing library (all versions through 1.9.1) allows any remote unauth
CVE-2026-8445 CRITICAL
9.3 Aug 23

Sanitizer bypass in the justhtml Python library (versions <= 1.11.0) allows attacker-controlled input to survive as raw

CVE-2026-7808 CRITICAL
9.3 Aug 23

Cross-site scripting via HTML sanitization bypass affects justhtml (a Python HTML parsing/sanitization library by EmilSt
CVE-2026-5388 CRITICAL
9.3 Aug 23

Sanitization bypass in justhtml (a Python HTML/Markdown sanitization library) before 1.15.0 lets attacker-controlled inp
CVE-2026-4671 HIGH
8.7 Aug 23

Uncontrolled resource consumption in justhtml before 1.18.0 enables denial-of-service conditions through CPU and memory

CVE-2026-74793 MEDIUM
5.1 Aug 23

Cross-site scripting in justhtml before 3.11.0 allows remote unauthenticated attackers to execute arbitrary JavaScript i
CVE-2026-8630 MEDIUM
5.1 Aug 23

Mutation XSS in justhtml (versions ≤1.11.0) allows injection of arbitrary HTML into serialized output when applications

CVE-2026-5751 MEDIUM
5.1 Aug 23

Mutation XSS (mXSS) in justhtml 1.13.0 and earlier enables markup injection bypass against applications using non-defaul
CVE-2026-5389 MEDIUM
5.1 Aug 23

Cross-site scripting in justhtml versions before 1.13.0 allows attackers who control `<pre>` element content to break ou
CVE-2026-6827 MEDIUM
5.1 Aug 23

Sanitization bypass in justhtml (Python HTML sanitization library) before version 1.17.0 enables cross-site scripting in

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8

Share

EUVD-2026-64657 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy