4vulnerabilities
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate3 (75.0%)
- Low1 (25.0%)
showdown
Ecosystem: npm
Downloads: 5.95 Mln
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 3ModerateAffects 3 versions
- 1LowAffects 1 version
Monthly breakdown
- Critical
- High
- Medium
- Moderate
- Low
- 2 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 2
- Low: 0
- 1 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 1
- Low: 0
- 1 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 0
- Low: 1
Vulnerabilities (4)
Known vulnerabilities affecting showdown, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-22g5-r2x5-97cx | Moderate | showdown allows stored cross-site scripting through table header ID injectionshowdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails to properly escape table header ID attributes. Attackers can inject arbitrary HTML and script-executing SVG elements through double-quote characters in markdown table headers, achieving stored XSS when untrusted markdown is rendered with the default github flavor configuration. |
| GitHub (opens in a new tab) | |
| GHSA-cr32-g25g-vxjj | Moderate | showdown metadata title handling allows cross-site scriptingshowdown contains a cross-site scripting vulnerability in metadata title handling that allows attackers to inject arbitrary HTML and JavaScript. When completeHTMLDocument option is enabled, unescaped less-than and greater-than characters in markdown frontmatter metadata are inserted directly into HTML title tags, enabling attackers to break out of the title context and execute malicious scripts in the rendered page. |
| GitHub (opens in a new tab) | |
| GHSA-rmmh-p597-ppvv | Moderate | Showdown vulnerable to Regular Expression Denial of Service (ReDoS) in link/anchor parsingShowdownjs, versions <= 2.1.0, `anchors` subparser used to parse links has a nested regular expression which can lead to denial of service conditions given malicious input. |
| GitHub (opens in a new tab) | |
| GHSA-h6mq-3cj6-h738 | Low | Reverse Tabnabbing in showdownVersions of `showdown` prior to 1.9.1 are vulnerable to [Reverse Tabnabbing](https://www.owasp.org/index.php/Reverse_Tabnabbing). The package uses `target='_blank'` in anchor tags, allowing attackers to access `window.opener` for the original page when opening links. This is commonly used for phishing attacks. ## Recommendation Upgrade to version 1.9.1 or later. |
| GitHub (opens in a new tab) |
- GHSA-22g5-r2x5-97cxModerateshowdown allows stored cross-site scripting through table header ID injection
<= 2.1.0
showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails to properly escape table header ID attributes. Attackers can inject arbitrary HTML and script-executing SVG elements through double-quote characters in markdown table headers, achieving stored XSS when untrusted markdown is rendered with the default github flavor configuration.
CVE: CVE-2026-59710
- GHSA-cr32-g25g-vxjjModerateshowdown metadata title handling allows cross-site scripting
<= 2.1.0
showdown contains a cross-site scripting vulnerability in metadata title handling that allows attackers to inject arbitrary HTML and JavaScript. When completeHTMLDocument option is enabled, unescaped less-than and greater-than characters in markdown frontmatter metadata are inserted directly into HTML title tags, enabling attackers to break out of the title context and execute malicious scripts in the rendered page.
CVE: CVE-2026-59711
- GHSA-rmmh-p597-ppvvModerateShowdown vulnerable to Regular Expression Denial of Service (ReDoS) in link/anchor parsing
<= 2.1.0
Showdownjs, versions <= 2.1.0, `anchors` subparser used to parse links has a nested regular expression which can lead to denial of service conditions given malicious input.
CVE: CVE-2024-1899
Versions of `showdown` prior to 1.9.1 are vulnerable to [Reverse Tabnabbing](https://www.owasp.org/index.php/Reverse_Tabnabbing). The package uses `target='_blank'` in anchor tags, allowing attackers to access `window.opener` for the original page when opening links. This is commonly used for phishing attacks. ## Recommendation Upgrade to version 1.9.1 or later.