Cross-Site Scripting Vulnerability in Showdown by ShowdownJS

CVE-2026-104477

What is CVE-2026-104477?

Showdown, versions through 2.1.0, is susceptible to a cross-site scripting vulnerability affecting the makehtml link and image subparsers. This issue arises from the failure to properly escape double quotes in the destination URLs embedded within href and src attributes. Malicious actors can exploit this flaw by crafting markdown links or images that include double quotes followed by onerror or onmouseover handlers, leading to the execution of scripts when the victim views the rendered HTML. It is crucial for users and developers to apply security patches and ensure that their systems remain protected against such vulnerabilities.

References