EUVD-2026-41948
GHSA-cr32-g25g-vxjj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
No privileges required to submit frontmatter content (PR:N); victim must load rendered page (UI:R); scope changes as victim browser session is affected (S:C), with limited confidentiality and integrity impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1Blast Radius
ecosystem impact- 953 npm packages depend on showdown (476 direct, 487 indirect)
Ecosystem-wide dependent count for version 2.1.0.
DescriptionCVE.org
showdown contains a cross-site scripting vulnerability in metadata title handling that allows attackers to inject arbitrary HTML and JavaScript. When completeHTMLDocument option is enabled, unescaped less-than and greater-than characters in markdown frontmatter metadata are inserted directly into HTML title tags, enabling attackers to break out of the title context and execute malicious scripts in the rendered page.
AnalysisAI
Cross-site scripting in Showdown (all versions ≤ 2.1.0) allows network-accessible injection of arbitrary HTML and JavaScript into rendered pages when the non-default completeHTMLDocument option is enabled. Unescaped < and > characters in Markdown frontmatter title metadata are written directly into the HTML <title> element, enabling title-context breakout and script execution in victim browsers. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the attack surface includes any web application that renders attacker-supplied Markdown with completeHTMLDocument enabled.
Technical ContextAI
Showdown (CPE: cpe:2.3:a:showdown:showdown:*:*:*:*:*:*:*:*) is a JavaScript library that converts Markdown to HTML, commonly used in web applications, wikis, and documentation platforms. Its completeHTMLDocument option generates a full HTML document skeleton - including <html>, <head>, and <title> tags - rather than the default fragment output. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): frontmatter metadata values, specifically the title field, are interpolated into the <title> element without HTML entity encoding. Because < and > are left unescaped, an attacker-controlled title such as foo</title><script>alert(document.cookie)</script> terminates the <title> context and injects executable content. This is a stored or reflected XSS depending on how the host application handles Markdown input and rendering.
RemediationAI
No vendor-released patched version has been confirmed at time of analysis; upstream fix progress can be tracked at https://github.com/showdownjs/showdown/issues/1047 and the VulnCheck advisory at https://www.vulncheck.com/advisories/showdown-cross-site-scripting-via-unescaped-metadata-title-in-completehtmldocument. The most effective immediate control is to disable the completeHTMLDocument option, which eliminates the vulnerable code path entirely with no functional impact on fragment-rendering use cases. If full HTML document generation is architecturally required, apply HTML entity encoding to all frontmatter metadata values before passing content to Showdown, or post-process the rendered output with a sanitization library such as DOMPurify prior to serving it to users - note that DOMPurify adds a runtime dependency and must be kept current. Restricting Markdown input to trusted, non-user-controlled sources removes the attack surface entirely. Monitor the upstream repository and VulnCheck advisory for a patched release.
An issue in the anchors subparser of Showdownjs versions <= 2.1.0 could allow a remote attacker to cause denial of servi
Stored cross-site scripting in the showdown JavaScript Markdown-to-HTML library allows an unauthenticated attacker to in
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today