Skip to content
OpenAdvisories

Package · npm

showdown

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • Medium 6.1
    CVE-2026-59710

    showdown - Stored XSS via Unescaped Table Header ID Attribute Injection

    showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails to properly escape table header ID attributes. Attackers can inject arbitrary HTML and script-executing SVG elements thr…

    showdown showdown showdown npm
  • Medium 6.1
    CVE-2026-59711

    showdown - Cross-Site Scripting via Unescaped Metadata Title in completeHTMLDocument

    showdown contains a cross-site scripting vulnerability in metadata title handling that allows attackers to inject arbitrary HTML and JavaScript. When completeHTMLDocument option is enabled, unescaped less-than and greater-than characters in markdown frontmatt…

    showdown showdown showdown npm
  • Medium 5.3
    CVE-2024-1899

    Showdownjs Denial of Service

    An issue in the anchors subparser of Showdownjs versions <= 2.1.0 could allow a remote attacker to cause denial of service conditions.

    showdownjs showdown showdown npm
  • Low 3.1
    GHSA-h6mq-3cj6-h738

    Reverse Tabnabbing in showdown

    Versions of `showdown` prior to 1.9.1 are vulnerable to [Reverse Tabnabbing](https://www.owasp.org/index.php/Reverse_Tabnabbing). The package uses `target='_blank'` in anchor tags, allowing attackers to access `window.opener` for the original page when openin…

    showdown npm