Vulnerability · Published Jul 6, 2026 · Assigned by VulnCheck

CVE-2026-59711showdown - Cross-Site Scripting via Unescaped Metadata Title in completeHTMLDocument

Medium 6.1

In plain English

A medium-severity cross-site scripting in showdown from showdown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.2%top 86.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

showdown contains a cross-site scripting vulnerability in metadata title handling that allows attackers to inject arbitrary HTML and JavaScript. When completeHTMLDocument option is enabled, unescaped less-than and greater-than characters in markdown frontmatter metadata are inserted directly into HTML title tags, enabling attackers to break out of the title context and execute malicious scripts in the rendered page.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	showdown	no fix listed	GHSA-cr32-g25g-vxjj

Affected products (as reported)

Vendor	Product	Versions
showdown	showdown	0 – through 2.1.0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

GitHub Issue issue-tracking
Product product
https://www.vulncheck.com/advisories/showdown-cross-site-scripting-via-unescaped-metadata-title-in-completehtmldocument third-party-advisory