showdown metadata title handling allows cross-site scripting

Description

showdown contains a cross-site scripting vulnerability in metadata title handling that allows attackers to inject arbitrary HTML and JavaScript.

Recommendation

No fix is available yet. Followings are affected versions:

<= 2.1.0

References

Could your website be exposed too?

SmartScanner can check your website for showdown metadata title handling allows cross-site scripting and gives you actionable findings to investigate.

Start a free scan

Related Issues

showdown allows stored cross-site scripting through table header ID injection - CVE-2026-59710
Vulnogram contains a stored cross-site scripting vulnerability in comment hypertext handling - CVE-2026-32774
DbGate has cross site scripting via the SVG Icon String Handler component - CVE-2026-6216
CKEditor 5 has Cross-site Scripting (XSS) in the HTML Support package - CVE-2026-28343

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

See something that needs correcting? Let us knowUpdated August 07, 2026