Executive brief
Showdown is a popular JavaScript library that converts Markdown to HTML. The library generates anchor tags with target="_blank" (opening links in new tabs) but failed to include protective attributes, allowing the linked website to access and potentially manipulate the original page through JavaScript. Attackers can use this for phishing or social engineering attacks.
Technical details
A reverse tabnabbing vulnerability (CWE-1022) exists in showdown versions prior to 1.9.1. When the openLinksInNewWindow option is enabled, generated anchor tags use target="_blank" without the rel="noopener noreferrer" attribute. This allows the destination website to access the window.opener property and modify the original page's location, commonly exploited for phishing. The attack requires user interaction (clicking a link) and is limited to the context where the Markdown is rendered in a browser. The fix adds rel="noopener noreferrer" to anchor tags when openLinksInNewWindow is enabled, preventing the destination site from accessing window.opener.
Affected products
- showdown showdown before 1.9.1
Timeline
- 2020-09-03: disclosed
- 2019-11-02: patched: Fix merged in PR #670