# CVE-2026-77088: justhtml to_markdown() cross-site scripting in code span

Source: https://junglewise.ai/threats/cve-2026-77088-justhtml-to-markdown-cross-site-scripting-in-code-span  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-23. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-77088 · Severity: medium · CVSS 6.1 · Published 2026-08-23

justhtml is a Python library that converts HTML to Markdown format, commonly used in systems that process user-generated HTML content. Versions 0.9.0 through 1.21.0 fail to properly handle blank lines within code blocks, allowing attackers to inject malicious HTML (such as JavaScript event handlers) that bypasses sanitization and executes in the browser. This can lead to account compromise, session hijacking, or stealing sensitive user data.

Technologies: [justhtml (PyPI)](https://junglewise.ai/threats/technologies/justhtml). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-77088 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77088 being exploited in the wild.

**How severe is CVE-2026-77088?** Medium severity, with a CVSS score of 6.1, published 23 August 2026.

**Which products and versions are affected?** justhtml (PyPI) ECOSYSTEM:introduced=0.9.0,fixed=1.22.0.

**Is there a fix for CVE-2026-77088?** Yes. justhtml (PyPI): upgrade to 1.22.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-77088 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-77088?** Check whether you run justhtml (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- justhtml (PyPI): upgrade to 1.22.0 or later

  ```sh
  pip install "justhtml>=1.22.0"
  ```


## Technical details

The vulnerability is a cross-site scripting (CWE-79) flaw arising from improper output encoding (CWE-116). The to_markdown() function converts HTML code and pre elements to Markdown inline code spans, using backtick fences to protect the content. However, the implementation fails to account for blank lines (\n\n), which are block boundaries in Markdown that terminate inline code spans. An attacker can inject a blank line into sanitized HTML code elements; when converted to Markdown, the blank line breaks the fence, leaving subsequent attacker-controlled text unescaped. Compliant Markdown renderers then re-parse this text as raw HTML, executing any embedded JavaScript. The vulnerability is reachable by default: the library sanitizes HTML but preserves code/pre elements and their text content, and the payload can be smuggled through character reference encoding (e.g., <img …>) to survive sanitization. A patch is available in version 1.22.0.

## Affected products

- Emil Stenstrom justhtml 0.9.0 through 1.21.0

## Identifiers

- CVE-2026-77088
- GHSA-jf6w-2mvx-633j

## Timeline

- 2026-05-22: disclosed: GitHub Security Advisory published
- 2026-08-23: advisory: CVE-2026-77088 published on NVD
- 2026-05-22: patched: Fix available in version 1.22.0

## References

- [https://github.com/EmilStenstrom/justhtml/security/advisories/GHSA-jf6w-2mvx-633j](https://github.com/EmilStenstrom/justhtml/security/advisories/GHSA-jf6w-2mvx-633j)
- [https://www.vulncheck.com/advisories/justhtml-through-cross-site-scripting-via-code-span](https://www.vulncheck.com/advisories/justhtml-through-cross-site-scripting-via-code-span)

## Related threats

- [justhtml uncontrolled recursion DoS via deeply nested HTML](https://junglewise.ai/threats/justhtml-uncontrolled-recursion-dos-via-deeply-nested-html-26591bb6)
- [JustHTML uncontrolled recursion DoS via deeply nested HTML](https://junglewise.ai/threats/cve-2026-9769-justhtml-uncontrolled-recursion-dos-via-deeply-nested-html)
- [justhtml mutation XSS in raw-text element serialization](https://junglewise.ai/threats/cve-2026-8630-justhtml-mutation-xss-in-raw-text-element-serialization)
- [justhtml HTML escaping bypass in Markdown conversion](https://junglewise.ai/threats/cve-2026-8445-justhtml-html-escaping-bypass-in-markdown-conversion)
- [justhtml HTML sanitization bypass leading to XSS](https://junglewise.ai/threats/cve-2026-7808-justhtml-html-sanitization-bypass-leading-to-xss)