CVE-2026-77088 json
justhtml 0.9.0 through 1.21.0 Cross-Site Scripting via code-span
published 4mo ago modified 30d ago also GHSA-jf6w-2mvx-633j , EUVD-2026-64657
- cvss
- 6.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 18%
- public exploits
- 0
- none known
Summary
justhtml versions 0.9.0 through 1.21.0 contain a cross-site scripting vulnerability in to_markdown() where inline code spans fail to account for blank lines as block boundaries. Attackers can inject blank lines into code or pre element text to break the inline span, causing sanitized HTML to be emitted unescaped and re-parsed as live Markdown by compliant renderers.
Patch / fix
- pypi justhtml 1.22.0
Is CVE-2026-77088 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2mo ago
Exploit prediction
0.26% chance of exploitation in the next 30 days, higher than 18% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N |
| CNA | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| GitHub | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | justhtml | >=0.9.0, <1.22.0 |
1.22.0 |
Affected products
- EmilStenstrom justhtml
Classification
References
-
github.com
/EmilStenstrom/justhtml/security/advisories/GHSA-jf6w-2mvx-633j
vendor-advisory, web
-
vulncheck.com
/advisories/justhtml-through-cross-site-scripting-via-code-span
third-party-advisory
-
github.com
/EmilStenstrom/justhtml
package
Sources
- CVE List CVE-2026-77088
- GitHub Advisory GHSA-jf6w-2mvx-633j
- NVD CVE-2026-77088
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.