The Showdown markdown-to-HTML converter has a cross-site scripting vulnerability (CVE-2026-59711) in how it processes metadata titles. Specifically, when the completeHTMLDocument option is enabled, unescaped < and > characters in markdown frontmatter metadata are directly inserted into HTML <title> tags without proper sanitization or escaping. This flaw allows attackers to break out of the title context and inject arbitrary HTML and JavaScript, leading to potential script execution in users' browsers. The vulnerability affects all versions up to and including 2.1.0. There is no information about an available patch or official fix at this time.

An attacker can exploit this vulnerability to execute arbitrary scripts in the context of the affected web page by injecting malicious code into the metadata title. This can lead to partial compromise of confidentiality and integrity (as indicated by the CVSS vector: low confidentiality and integrity impact) but does not affect availability. The vulnerability requires user interaction (UI:R) and can be exploited remotely without privileges (AV:N, PR:N).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling the completeHTMLDocument option or sanitizing metadata titles before processing. Avoid using untrusted input in markdown frontmatter metadata that will be rendered into HTML title tags.