justhtml 0.9.0 through 1.21.0 contains a cross‑site scripting vulnerability in its to_markdown() function; the flaw arises when inline code spans do not consider blank lines as block boundaries. An attacker can inject blank lines into code or pre element text to break the inline span, causing sanitized HTML to be output unescaped. The unescaped output is then re‑parsed as live Markdown by compliant renderers, which can deliver executable script to a victim’s browser.

The bug affects the justhtml library distributed by EmilStenstrom. Any application that uses justhtml versions 0.9.0 to 1.21.0 to convert user‑supplied content to Markdown or HTML is potentially impacted.

The CVSS score of 5.3 indicates a moderate risk profile. No EPSS score is available and the issue is not listed in the KEV catalog. The likely attack vector is injection of malicious content into a field that the application passes to to_markdown(); if the rendered output is served to other users, the XSS can lead to script execution or session hijacking. No elevated privileges are required beyond the ability to supply content to the conversion routine.