Approved changes feed: RSS · Atom
cpe:2.3:a:showdownjs:showdown:*:*:*:*:*:node.js:*:*part: a version: * update: *
| Vendor | Showdownjs (7ce340ae-221b-57de-9278-8898e8e54b13) |
|---|---|
| Product | Showdown (7364a48e-2e71-5072-ae3c-c87ee171872f) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | node.js |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-59711 |
vulnerable | 2026-07-29 01:03:17.554760 |
showdown - Cross-Site Scripting via Unescaped Metadata Title in completeHTMLDocument
MEDIUM (6.1)
showdown contains a cross-site scripting vulnerability in metadata title handling that allows attackers to inject arbitrary HTML and JavaScript. When completeHTMLDocument option is enabled, unescaped less-than and greater-than characters in markdown frontmatter metadata are inserted directly into HTML title tags, enabling attackers to break out of the title context and execute malicious scripts in the rendered page.
Published: 2026-07-06T21:00:38.491Z
Updated: 2026-07-07T14:06:55.895Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-59710 |
vulnerable | 2026-07-29 01:03:17.554418 |
showdown - Stored XSS via Unescaped Table Header ID Attribute Injection
MEDIUM (6.1)
showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails to properly escape table header ID attributes. Attackers can inject arbitrary HTML and script-executing SVG elements through double-quote characters in markdown table headers, achieving stored XSS when untrusted markdown is rendered with the default github flavor configuration.
Published: 2026-07-06T21:15:45.900Z
Updated: 2026-07-07T13:47:54.393Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-1899 |
vulnerable | 2026-06-08 06:27:14.886974 |
Showdownjs Denial of Service
MEDIUM (5.3)
An issue in the anchors subparser of Showdownjs versions <= 2.1.0 could allow a remote attacker to cause denial of service conditions.
Published: 2024-02-26T18:45:23.289Z
Updated: 2024-08-01T18:56:22.277Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.