GHSA-cr32-g25g-vxjj

Suggest an improvement
Source
https://github.com/advisories/GHSA-cr32-g25g-vxjj
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-cr32-g25g-vxjj/GHSA-cr32-g25g-vxjj.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-cr32-g25g-vxjj
Aliases
Downstream
CGA (12)
MINI (6)
Published
2026-07-06T21:30:43Z
Modified
2026-08-07T21:26:12Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
showdown metadata title handling allows cross-site scripting
Details

showdown contains a cross-site scripting vulnerability in metadata title handling that allows attackers to inject arbitrary HTML and JavaScript. When completeHTMLDocument option is enabled, unescaped less-than and greater-than characters in markdown frontmatter metadata are inserted directly into HTML title tags, enabling attackers to break out of the title context and execute malicious scripts in the rendered page.

Database specific 
{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-08-07T21:05:38Z",
    "nvd_published_at":  "2026-07-06T21:16:58Z",
    "severity":  "MODERATE"
}
References

Affected packages

npm / showdown

Package

Name
showdown
View open source insights on deps.dev
Purl
pkg:npm/showdown

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Last Affected
2.1.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-cr32-g25g-vxjj/GHSA-cr32-g25g-vxjj.json"