showdown metadata title handling allows cross-site scripting

Description

showdown contains a cross-site scripting vulnerability in metadata title handling that allows attackers to inject arbitrary HTML and JavaScript.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 2.1.0

References

• GHSA-cr32-g25g-vxjj
• www.vulncheck.com
• CVE-2026-59711
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• showdown allows stored cross-site scripting through table header ID injection - CVE-2026-59710
• Vulnogram contains a stored cross-site scripting vulnerability in comment hypertext handling - CVE-2026-32774
• DbGate has cross site scripting via the SVG Icon String Handler component - CVE-2026-6216
• CKEditor 5 has Cross-site Scripting (XSS) in the HTML Support package - CVE-2026-28343

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

showdown