showdown vulnerabilities

Showdown through 2.1.0 contains a cross-site scripting vulnerability in the makehtml link and image subparsers, which fail to escape double quotes in destination URLs placed into href and src attributes. Attackers can craft markdown links or images containing a double quote followed by onerror or onmouseover handlers to execute script when victims view rendered HTML.

A stored cross-site scripting vulnerability exists in the showdown library's parseHeaders function in src/subParsers/makehtml/tables.js, which fails to properly escape table header ID attributes. Attackers can inject arbitrary HTML and script-executing SVG elements via double-quote characters in Markdown table headers, achieving stored XSS when untrusted Markdown is rendered with the default GitHub flavor configuration.

The showdown library contains a cross-site scripting vulnerability in metadata title handling. When the completeHTMLDocument option is enabled, unescaped less-than and greater-than characters in markdown frontmatter metadata are inserted directly into HTML title tags, allowing attackers to inject arbitrary HTML and JavaScript.