VULNERABILITY INTELLIGENCE
CVE-2026-5389
CVSS score5.1 MEDIUM
EPSS probability0.23%
CISA KEVNot currently listed
Published2026-08-23
Last modified2026-10-12
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Description
justhtml versions before 1.13.0 contain a cross-site scripting vulnerability in the to_markdown() function when serializing attacker-controlled pre content. Attackers can place backticks inside sanitized pre elements to break out of fixed-length code fences, allowing raw HTML to execute when the generated Markdown is rendered by CommonMark or GFM-style renderers.
Weakness classification
- CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)