Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Low severity, with a CVSS score of 3.1, published 3 September 2020.

Which products and versions are affected?

showdown (npm) SEMVER:introduced=0,fixed=1.9.1.

Is there a fix for This vulnerability?

Yes. showdown (npm): upgrade to 1.9.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run showdown (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

showdown reverse tabnabbing in anchor tags

Severity: low · CVSS 3.1 · Published 2020-09-03

Showdown is a popular JavaScript library that converts Markdown to HTML. The library generates anchor tags with target="_blank" (opening links in new tabs) but failed to include protective attributes, allowing the linked website to access and potentially manipulate the original page through JavaScript. Attackers can use this for phishing or social engineering attacks.

Technologies: showdown (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Low severity, with a CVSS score of 3.1, published 3 September 2020.
Which products and versions are affected?: showdown (npm) SEMVER:introduced=0,fixed=1.9.1.
Is there a fix for This vulnerability?: Yes. showdown (npm): upgrade to 1.9.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run showdown (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

showdown (npm): upgrade to 1.9.1 or later
```
npm install showdown@1.9.1
```

Technical details

A reverse tabnabbing vulnerability (CWE-1022) exists in showdown versions prior to 1.9.1. When the openLinksInNewWindow option is enabled, generated anchor tags use target="_blank" without the rel="noopener noreferrer" attribute. This allows the destination website to access the window.opener property and modify the original page's location, commonly exploited for phishing. The attack requires user interaction (clicking a link) and is limited to the context where the Markdown is rendered in a browser. The fix adds rel="noopener noreferrer" to anchor tags when openLinksInNewWindow is enabled, preventing the destination site from accessing window.opener.

Affected products

showdown showdown before 1.9.1

Timeline

2020-09-03: disclosed
2019-11-02: patched: Fix merged in PR #670

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.