GitHub Advisoryadvisory · npm

GHSA-cr32-g25g-vxjj showdown metadata title handling allows cross-site scripting

MEDIUM Published 2026-07-06 Modified 2026-08-07 Official page ↗
Aliases
CVE-2026-59711
Ecosystem
npm
Packages
showdown
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2026-08-07

Affected packages

• npm showdown: <= 2.1.0 (no fix yet)

Description

showdown contains a cross-site scripting vulnerability in metadata title handling that allows attackers to inject arbitrary HTML and JavaScript. When completeHTMLDocument option is enabled, unescaped less-than and greater-than characters in markdown frontmatter metadata are inserted directly into HTML title tags, enabling attackers to break out of the title context and execute malicious scripts in the rendered page.

Related

Alias · CVE (1)

  • CVE-2026-59711 showdown contains a cross-site scripting vulnerability in metadata title handling that allows attackers to inject arbitrary HTML and… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References