Threats tagged 'ghsa-gc85-xrjc-cv75'

Showdown versions up to and including 2.1.0 contain a cross-site scripting (XSS) vulnerability in the makehtml link and image subparsers. The vulnerability arises because double quotes in destination URLs are not properly escaped when inserted into href and src attributes. This allows attackers to craft markdown links or images with embedded event handlers like onerror or onmouseover, which execute script when the rendered HTML is viewed. The CVSS 4.0 score is 5.3, indicating a medium severity vulnerability.