CVE-2026-77088: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in EmilStenstrom justhtml

CVE-2026-77088 describes a cross-site scripting vulnerability in EmilStenstrom's justhtml library versions 0.9.0 through 1.21.0. The flaw exists in the to_markdown() function where inline code spans fail to treat blank lines as block boundaries. Attackers can exploit this by injecting blank lines into code or pre element text, which breaks the inline span and causes sanitized HTML to be output without escaping. This unescaped HTML is then re-parsed as live Markdown by compliant Markdown renderers, enabling injection of malicious scripts.

The vulnerability allows an attacker to inject malicious content that is executed in the context of users viewing Markdown rendered by justhtml. This can lead to cross-site scripting attacks, potentially compromising user data or session information. The CVSS 4.0 score is 5.3 (medium severity), indicating a moderate risk with network attack vector, low complexity, no privileges required, and user interaction needed.

No official patch or remediation information is provided in the vendor advisory or input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider avoiding use of affected versions or applying manual input sanitization to prevent injection of blank lines in code or pre elements.