Skip to content
OpenAdvisories

Vendor

showdown

2 known vulnerabilities.

Products

showdown 2
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.1
    CVE-2026-59710

    showdown - Stored XSS via Unescaped Table Header ID Attribute Injection

    showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails to properly escape table header ID attributes. Attackers can inject arbitrary HTML and script-executing SVG elements thr…

    showdown showdown showdown npm
  • Medium 6.1
    CVE-2026-59711

    showdown - Cross-Site Scripting via Unescaped Metadata Title in completeHTMLDocument

    showdown contains a cross-site scripting vulnerability in metadata title handling that allows attackers to inject arbitrary HTML and JavaScript. When completeHTMLDocument option is enabled, unescaped less-than and greater-than characters in markdown frontmatt…

    showdown showdown showdown npm