Skip to content
OpenAdvisories

Vendor

showdownjs

2 known vulnerabilities.

Products

showdown 2
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.1
    CVE-2026-104477

    Showdown through 2.1.0 XSS via unescaped quote in href and src attributes

    Showdown through 2.1.0 contains a cross-site scripting vulnerability in the makehtml link and image subparsers, which fail to escape double quotes in destination URLs placed into href and src attributes. Attackers can craft markdown links or images containing…

    showdownjs showdown
  • Medium 5.3
    CVE-2024-1899

    Showdownjs Denial of Service

    An issue in the anchors subparser of Showdownjs versions <= 2.1.0 could allow a remote attacker to cause denial of service conditions.

    showdownjs showdown showdown npm