Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2026-104477

Showdown through 2.1.0 XSS via unescaped quote in href and src attributes

Showdown through 2.1.0 contains a cross-site scripting vulnerability in the makehtml link and image subparsers, which fail to escape double quotes in destination URLs placed into href and src attributes. Attackers can craft markdown links or images containing a double quote followed by onerror or onmouseover handlers to execute script when victims view rendered HTML.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Showdownjs
Products
Showdown
CVE-2026-59711

showdown - Cross-Site Scripting via Unescaped Metadata Title in completeHTMLDocument

showdown contains a cross-site scripting vulnerability in metadata title handling that allows attackers to inject arbitrary HTML and JavaScript. When completeHTMLDocument option is enabled, unescaped less-than and greater-than characters in markdown frontmatter metadata are inserted directly into HTML title tags, enabling attackers to break out of the title context and execute malicious scripts in the rendered page.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Showdownjs
Products
Showdown
CVE-2026-59710

showdown - Stored XSS via Unescaped Table Header ID Attribute Injection

showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails to properly escape table header ID attributes. Attackers can inject arbitrary HTML and script-executing SVG elements through double-quote characters in markdown table headers, achieving stored XSS when untrusted markdown is rendered with the default github flavor configuration.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Showdownjs
Products
Showdown
CVE-2024-1899

Showdownjs Denial of Service

An issue in the anchors subparser of Showdownjs versions <= 2.1.0 could allow a remote attacker to cause denial of service conditions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Showdownjs
Products
Showdown