Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-59711

showdown - Cross-Site Scripting via Unescaped Metadata Title in completeHTMLDocument

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

showdown contains a cross-site scripting vulnerability in metadata title handling that allows attackers to inject arbitrary HTML and JavaScript. When completeHTMLDocument option is enabled, unescaped less-than and greater-than characters in markdown frontmatter metadata are inserted directly into HTML title tags, enabling attackers to break out of the title context and execute malicious scripts in the rendered page.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

showdown showdown

Default version status: unaffected

  • 0 to ≤ 2.1.0affected
pkg:npm/showdown

References