Executive brief
Showdown, a popular library used to convert Markdown text into HTML, contains a security flaw in how it handles document titles. If a website uses Showdown to generate full web pages from user-provided content, an attacker could provide a specially crafted title that injects malicious scripts into the page. This could allow the attacker to steal user session information, perform actions on behalf of users, or deface the website for anyone viewing the rendered content.
Technical details
A cross-site scripting (XSS) vulnerability exists in Showdown's metadata parsing logic within `src/subParsers/makehtml/metadata.js` and `src/subParsers/makehtml/completeHTMLDocument.js`. When both the `metadata` and `completeHTMLDocument` options are enabled, the library fails to escape less-than (<) and greater-than (>) characters in the YAML frontmatter 'title' field. An attacker can provide markdown containing a title like `</title><script>alert(1)</script>`, which breaks out of the HTML `<title>` context when the full document is rendered. This allows for arbitrary script execution in the context of the web application. The vulnerability is present in versions up to and including 2.1.0.
Affected products
- showdownjs showdown <= 2.1.0
Timeline
- 2026-03-12: disclosed: Issue reported on GitHub repository
- 2026-07-06: advisory: NVD and GitHub Advisory published