CVE-2026-104477: Showdown through 2.1.0 XSS via unescaped quote in href and src attributes
Showdown through 2.1.0 contains a cross-site scripting vulnerability in the makehtml link and image subparsers, which fail to escape double quotes in destination URLs placed into href and src attributes. Attackers can craft markdown links or images containing a double quote followed by onerror or onmouseover handlers to execute script when victims view rendered HTML.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using npm/showdown through version 2.1.0 are exposed if they render attacker-controlled or otherwise untrusted Markdown and users subsequently view the generated HTML.
What does an attacker need to exploit it?
An attacker needs to supply a Markdown link or image destination URL containing a double quote and an event handler such as onerror or onmouseover. Exploitation also requires a victim to view the rendered HTML.
What is the potential impact?
Successful exploitation executes script in the context of the page displaying the rendered Markdown. The supplied severity vector indicates low confidentiality and integrity impact, with no availability impact.