Description
Versions of showdown prior to 1.9.1 are vulnerable to Reverse Tabnabbing. The package uses target='_blank' in anchor tags, allowing attackers to access window.opener for the original page when opening links. This is commonly used for phishing attacks.
Recommendation
Update the showdown package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.9.1
- Patched version(s): 1.9.1
References
Could your website be exposed too?
SmartScanner can check your website for Reverse Tabnabbing in showdown and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Reverse Tabnabbing in quill - Vulnerability
- Reverse Tabnapping in swagger-ui - Vulnerability
- CKEditor cross-site scripting vulnerability in AJAX sample - CVE-2023-4771
- esbuild enables any website to send any requests to the development server and read the response - Vulnerability
You might also like:
See something that needs correcting? Let us knowUpdated April 05, 2023