CVE-2026-104477
MediumCVSS 6.1Summary
Showdown through 2.1.0 contains a cross-site scripting vulnerability in the makehtml link and image subparsers, which fail to escape double quotes in destination URLs placed into href and src attributes. Attackers can craft markdown links or images containing a double quote followed by onerror or onmouseover handlers to execute script when victims view rendered HTML.
Risk Assessment
An attacker can execute arbitrary JavaScript in the victim's browser, potentially leading to credential theft or other actions. This affects any application using Showdown to render markdown.
Recommendation
Update Showdown to a version later than 2.1.0. If updating is not possible, consider sanitizing markdown input.
Other vulnerabilities in Showdown
See all- CVE-2026-59710Medium
A stored cross-site scripting vulnerability exists in the showdown library's parseHeaders function in src/subParsers/makehtml/tables.js, which fails to properly escape table header ID attributes. Attackers can inject arbitrary HTML and script-executing SVG elements via double-quote characters in Markdown table headers, achieving stored XSS when untrusted Markdown is rendered with the default GitHub flavor configuration.
- CVE-2026-59711Medium
The showdown library contains a cross-site scripting vulnerability in metadata title handling. When the completeHTMLDocument option is enabled, unescaped less-than and greater-than characters in markdown frontmatter metadata are inserted directly into HTML title tags, allowing attackers to inject arbitrary HTML and JavaScript.
Original NVD description (English source)
Showdown through 2.1.0 contains a cross-site scripting vulnerability in the makehtml link and image subparsers, which fail to escape double quotes in destination URLs placed into href and src attributes. Attackers can craft markdown links or images containing a double quote followed by onerror or onmouseover handlers to execute script when victims view rendered HTML.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS