The vulnerability in justhtml affects versions 0.9.0 through 1.21.0 in the to_markdown() function. Inline code spans fail to treat blank lines as block boundaries, enabling attackers to inject blank lines into code or pre element text. This breaks the inline span, causing sanitized HTML to be output unescaped and subsequently re-parsed as live Markdown by renderers that comply with this behavior. This improper neutralization of input during web page generation leads to a cross-site scripting vulnerability.

An attacker can exploit this vulnerability to inject malicious scripts that execute in the context of users viewing the affected Markdown-rendered content. This can lead to typical XSS impacts such as session hijacking, defacement, or redirection to malicious sites. The CVSS score of 5.3 (medium severity) reflects that the attack vector is network-based with low complexity and no privileges required, but user interaction is needed and the impact on confidentiality, integrity, and availability is low to limited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input sanitization workarounds or avoid using vulnerable versions. Monitor the vendor's communications for updates regarding patches or official mitigations.