Threats affecting pkg:npm/showdown

Showdown versions up to and including 2.1.0 contain a cross-site scripting (XSS) vulnerability in the makehtml link and image subparsers. The vulnerability arises because double quotes in destination URLs are not properly escaped when inserted into href and src attributes. This allows attackers to craft markdown links or images with embedded event handlers like onerror or onmouseover, which execute script when the rendered HTML is viewed. The CVSS 4.0 score is 5.3, indicating a medium severity vulnerability.

Showdown contains a stored cross-site scripting (XSS) vulnerability in its table header ID parsing function. The vulnerability arises because the parseHeaders function in src/subParsers/makehtml/tables.js does not properly escape double-quote characters in markdown table headers. This allows attackers to inject arbitrary HTML and script-executing SVG elements, leading to stored XSS when untrusted markdown is rendered using the default GitHub flavor configuration. The vulnerability affects all versions up to and including 2.1.0. The CVSS score is 6.1, indicating a medium severity issue.

Showdown has a cross-site scripting (XSS) vulnerability in how it handles metadata titles when the completeHTMLDocument option is enabled. Unescaped less-than and greater-than characters in markdown frontmatter metadata are injected directly into HTML title tags, allowing arbitrary HTML and JavaScript injection. This affects all versions up to and including 2.1.0. The vulnerability is rated medium severity with a CVSS score of 6.1.