XSS in Showdown Markdown Parser via Metadata Title

Publication date: 2026-07-06

Last updated on: 2026-07-06

Assigner: VulnCheck

Description

showdown contains a cross-site scripting vulnerability in metadata title handling that allows attackers to inject arbitrary HTML and JavaScript. When completeHTMLDocument option is enabled, unescaped less-than and greater-than characters in markdown frontmatter metadata are inserted directly into HTML title tags, enabling attackers to break out of the title context and execute malicious scripts in the rendered page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-06

Last Modified

2026-07-06

Generated

2026-07-07

AI Q&A

2026-07-07

EPSS Evaluated

N/A

NVD

CVE-2026-59711

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Impact Analysis

The vulnerability can lead to the execution of malicious scripts in users' browsers when they view pages rendered by showdown with the affected configuration. This can result in unauthorized actions, data theft, session hijacking, or other malicious activities performed by attackers exploiting the cross-site scripting flaw.

Executive Summary

This vulnerability exists in showdown, where a cross-site scripting (XSS) flaw occurs in the handling of metadata titles. Specifically, when the completeHTMLDocument option is enabled, unescaped less-than and greater-than characters in markdown frontmatter metadata are directly inserted into HTML title tags. This allows attackers to inject arbitrary HTML and JavaScript, breaking out of the title context and executing malicious scripts on the rendered page.

Hi! I’m here to help you understand CVE-2026-59711. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70