CVE-2026-77088 Overview
CVE-2026-77088 is a cross-site scripting (XSS) vulnerability in the justhtml Python library, affecting versions 0.9.0 through 1.21.0. The flaw resides in the to_markdown() function, which converts sanitized HTML back to Markdown. The function fails to treat blank lines as block boundaries when parsing inline code spans. Attackers can inject blank lines inside code or pre element text to break the inline span. Sanitized HTML then emits unescaped and is re-parsed as live Markdown by compliant renderers, enabling script execution in downstream applications. The vulnerability is classified under CWE-79.
Critical Impact
Attackers can smuggle executable Markdown through HTML sanitization, resulting in stored or reflected XSS in applications that render justhtml output.
Affected Products
- justhtml versions 0.9.0 through 1.21.0
- Applications using justhtml.to_markdown() for HTML-to-Markdown conversion
- Downstream Markdown renderers consuming justhtml output
Discovery Timeline
- 2026-08-23 - CVE-2026-77088 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-77088
Vulnerability Analysis
The justhtml library provides an HTML-to-Markdown conversion path intended to normalize and sanitize user-supplied HTML. Applications rely on the assumption that output from to_markdown() is safe to render through a Markdown pipeline. That assumption breaks when inline code spans contain blank lines.
Markdown specifications treat blank lines as hard block boundaries. Inline code spans, delimited by backticks, cannot span across blank lines. When justhtml serializes the contents of <code> or <pre> elements into a single inline code span, it does not check for embedded blank lines. A compliant downstream renderer terminates the code span at the blank line and begins parsing the remainder as regular Markdown.
Content that the sanitizer treated as inert text becomes active Markdown, including raw HTML blocks and script-bearing constructs. The attacker controls both halves of the split output.
Root Cause
The root cause is missing block-boundary validation in to_markdown() when emitting inline code spans. The serializer wraps element text with backticks without escaping or restructuring content that contains blank lines. This violates the Markdown contract between the sanitizer and any CommonMark-compliant renderer consuming its output.
Attack Vector
Exploitation requires an attacker to submit HTML containing a <code> or <pre> element whose text includes at least one blank line followed by malicious Markdown or raw HTML. The attacker delivers this payload through any input surface that flows into justhtml.to_markdown(), such as comment fields, wiki edits, or message bodies. User interaction is required to render the resulting Markdown in a victim's browser. Full technical details are available in the GitHub Security Advisory and the VulnCheck Advisory on JustHTML.
No verified proof-of-concept code is published at this time. The advisories describe the mechanism in prose without releasing exploitation payloads.
Detection Methods for CVE-2026-77088
Indicators of Compromise
- Stored user content containing <code> or <pre> elements with embedded blank lines followed by HTML tags or Markdown link syntax.
- Rendered pages exhibiting unexpected inline scripts, iframes, or event handlers originating from fields that pass through justhtml.
- Server logs showing POST bodies with backtick sequences interleaved with blank lines around <script> or javascript: tokens.
Detection Strategies
- Inventory application dependencies for justhtml versions 0.9.0 through 1.21.0 using SBOM tooling or pip list.
- Add server-side content inspection that rejects HTML input where <code> or <pre> element text contains consecutive newlines.
- Instrument to_markdown() calls to log outputs containing backtick sequences separated by blank lines for offline review.
Monitoring Recommendations
- Enable Content Security Policy (CSP) reporting to surface script execution originating from user-generated content surfaces.
- Correlate web application firewall alerts on XSS signatures with the specific endpoints that feed justhtml.
- Review audit logs for spikes in comment or Markdown submissions containing paired backticks and blank lines.
How to Mitigate CVE-2026-77088
Immediate Actions Required
- Upgrade justhtml to a fixed release above 1.21.0 as identified in the GitHub Security Advisory.
- Audit application code paths that call to_markdown() and confirm outputs pass through a strict CommonMark renderer with HTML disabled.
- Enforce a Content Security Policy that blocks inline scripts and untrusted script sources on pages rendering converted Markdown.
Patch Information
The maintainer of justhtml has issued a security advisory tracked as GHSA-jf6w-2mvx-633j. Consult the GitHub Security Advisory for the fixed version identifier and upgrade instructions. Pin the fixed version in requirements.txt or the equivalent dependency manifest.
Workarounds
- Pre-process HTML input to strip blank lines inside <code> and <pre> element text before invoking to_markdown().
- Post-process to_markdown() output to escape backticks or collapse blank lines inside code spans prior to rendering.
- Configure the downstream Markdown renderer to disable raw HTML pass-through, reducing the impact of a successful span break.
# Pin a fixed justhtml release once published
pip install --upgrade 'justhtml>1.21.0'
pip freeze | grep -i justhtml
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
