CVE-2026-77088

justhtml versions 0.9.0 through 1.21.0 are affected by a cross-site scripting (XSS) vulnerability in the to_markdown() function. The root cause is that inline code spans fail to treat blank lines as block boundaries. An attacker can inject blank lines into or element text to break the inline sp...

GHSA-JF6W-2MVX-633J justhtml: to_markdown() code-span blank-line breakout enables XSS

justhtml: tomarkdown code-span blank-line breakout enables XSS Summary In justhtml 0.9.0 through 1.21.0, tomarkdown renders text and text inside a link as an inline Markdown code span whose only protection is backtick-fence length. A blank line \n\n in that text terminates the inline span in any...