CVE-2026-59711
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The showdown library contains a cross-site scripting vulnerability in metadata title handling. When the completeHTMLDocument option is enabled, unescaped less-than and greater-than characters in markdown frontmatter metadata are inserted directly into HTML title tags, allowing attackers to inject arbitrary HTML and JavaScript.
Risk Assessment
An attacker can exploit this vulnerability to execute malicious scripts in the victim's browser, potentially leading to session theft, redirects to malicious sites, or theft of sensitive data.
Recommendation
It is recommended to immediately update the showdown library to the latest version that includes a fix for this vulnerability. If an update is not possible, disable the completeHTMLDocument option.
Original NVD description (English source)
showdown contains a cross-site scripting vulnerability in metadata title handling that allows attackers to inject arbitrary HTML and JavaScript. When completeHTMLDocument option is enabled, unescaped less-than and greater-than characters in markdown frontmatter metadata are inserted directly into HTML title tags, enabling attackers to break out of the title context and execute malicious scripts in the rendered page.