CVE-2026-5389

MediumCVSS 6.1/10Last modified Oct 12, 2026

Description

justhtml versions before 1.13.0 contain a cross-site scripting vulnerability in the to_markdown() function when serializing attacker-controlled pre content. Attackers can place backticks inside sanitized pre elements to break out of fixed-length code fences, allowing raw HTML to execute when the generated Markdown is rendered by CommonMark or GFM-style renderers.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-80

Affected software

Vendor	Product	Versions
EmilStenstrom	justhtml	< 1.13.0

References

Timeline

Published: Aug 23, 2026
Last modified: Oct 12, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-538996.5Firefox for iOS used partial domain matching when attaching cookies to PDF requests, allowing a malicious site on a suffix domain to receive CVE-2026-539004.3Firefox for iOS preserved cookies set on the initial PDF request across cross-origin HTTP redirects in TemporaryDocument, allowing a malicio CVE-2026-539018.7Cerebrate before version 1.37 contains a mass-assignment vulnerability in the generic CRUD add path. The add() handler attempted to remove a CVE-2026-539026.5MCO does not properly enforce authorization checks in the /customer/servlet/mco/webapi/profile-sections/group-membership endpoint. An authen CVE-2026-539038.1MCO is vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability in the /customer/servlet/mco/webapi/trading-document/fetchPdfS CVE-2026-539047.1MCO is vulnerable to Account Denial of Service due to improper implementation of password reset functionality. Each password reset request i CVE-2026-539057.1MCO does not properly enforce authorization checks in the /customer/servlet/mco/webapi/admin-view-hierarchy/get-acl-tree-structure endpoint.CVE-2026-539068.2MCO is vulnerable to Path Disclosure and Path Traversal in file handling functionality related to data export and upload. Improper validatio CVE-2026-539075.4MCO is vulnerable to Stored Cross‑Site Scripting (XSS) via the application logo upload functionality. An attacker with the ability to change CVE-2026-539084.3MCO is vulnerable to User Enumeration through authentication-related functionalities. The application returns distinguishable responses for CVE-2026-539096.5MCO does not correctly validate types of uploaded files. File upload validation functionality relies only on client-side checks, which can b CVE-2026-53916.4The LatePoint plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btn_wrapper_classes' attribute of the 'latepoint_re