Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
justhtml versions 0.9.0 through 1.21.0 contain a cross-site scripting vulnerability in to_markdown() where inline code spans fail to account for blank lines as block boundaries. Attackers can inject blank lines into code or pre element text to break the inline span, causing sanitized HTML to be emitted unescaped and re-parsed as live Markdown by compliant renderers.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-77088 Cross-Site Scripting in justhtml 0.9.0 Through 1.21.0 via Inline Code Spans https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-77088
Post summary
The post announces a Cross‑Site Scripting flaw in justhtml 0.9.0 through 1.21.0 caused by inline code spans, referencing a Vulmon vulnerability detail page.
🚨*CVE* CVE-2026-77088 justhtml versions 0.9.0 through 1.21.0 contain a cross-site scripting vulnerability in to_markdown() where inline code spans fail to account for blank lines as block … https://www.cve.org/CVERecord?id=CVE-2026-77088 ----- Traducción: CVE-2026-77088 jus… http://infoflow.cloud`
Post summary
A new CVE (CVE‑2026‑77088) has been disclosed for justhtml, describing an XSS flaw in the to_markdown() function; no proof of concept, exploit, or patch information is present.
CVE-2026-77088 justhtml versions 0.9.0 through 1.21.0 contain a cross-site scripting vulnerability in to_markdown() where inline code spans fail to account for blank lines as block … https://www.cve.org/CVERecord?id=CVE-2026-77088
Post summary
A cross‑site scripting vulnerability (XSS) exists in JustHTML’s `to_markdown()` function for versions 0.9.0‑1.21.0, caused by improper handling of inline code spans when blank lines are present.