Showdown has a cross-site scripting (XSS) vulnerability in how it handles metadata titles when the completeHTMLDocument option is enabled. Unescaped less-than and greater-than characters in markdown frontmatter metadata are injected directly into HTML title tags, allowing arbitrary HTML and JavaScript injection. This affects all versions up to and including 2.1.0. The vulnerability is rated medium severity with a CVSS score of 6.1.