Showdown CVE-2026-104477

The application must use Showdown (versions through 2.1.0) to render attacker-influenced markdown into HTML and display it to other users WITHOUT secondary output sanitization (e.g., no DOMPurify pass). The concrete trigger is a markdown link or image whose destination URL contains a double quote followed by an event handler (onerror for images, onmouseover for links), which escapes the quoted href/src attribute. LIMITING FACTORS: the victim must view the rendered output (UI:P) - onerror on a broken image fires automatically on load, while onmouseover requires the victim to hover; and per the patch's own code comments, CommonMark-spec ('cmSpec') flavors already percent-encode URLs and are therefore NOT affected, so only default/non-cmSpec flavors are exploitable.

This is a medium-severity stored/reflected cross-site scripting flaw (CWE-79) with a provided CVSS 4.0 base score of 5.3. The 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) shows network-reachable, low-complexity, no-privilege exploitation, but it is gated by passive user interaction (a victim must view the rendered HTML) and the impact metrics are only Low (VC:L/VI:L/VA:N) - consistent with client-side script execution in the victim's browser rather than server or host compromise. There is NO CISA KEV listing (not actively exploited) and NO EPSS score was provided in the input, so exploitation-probability data is MISSING and cannot be weighed. No standalone public exploit is identified, although the vendor patch commit (4fb992cd) ships regression tests containing working attribute-injection payloads, which materially lowers the bar for weaponization. Real-world priority is moderate and highly deployment-dependent: Showdown is a popular library, but exploitation only matters where the application renders attacker-influenced markdown and does NOT apply secondary output sanitization (e.g., DOMPurify). A key mitigating signal from the patch's own code comments is that CommonMark-spec ('cmSpec') flavors already percent-encode URLs and are therefore unaffected - so default/non-cmSpec configurations are the real exposure. Net: a genuine but not high-urgency issue; patch on a normal cycle unless rendering untrusted markdown without downstream sanitization.

An attacker submits markdown content (e.g., a comment, profile field, or document) containing a link or image whose URL embeds a double quote plus an event handler, such as ![a](<x" onerror=alert(1) src=y>). When Showdown converts it to HTML the unescaped quote breaks out of the src/href attribute, and when another user views the rendered page the injected onerror/onmouseover handler executes arbitrary JavaScript in that victim's browser session. No standalone public exploit is identified, but the fix commit includes test cases demonstrating functional payloads.