Medium severity · published Jul 6, 2026
CVE-2026-59711
showdown - Cross-Site Scripting via Unescaped Metadata Title in completeHTMLDocument
6.1
CVSS
0.2%
EPSS
No
On KEV
Description
showdown contains a cross-site scripting vulnerability in metadata title handling that allows attackers to inject arbitrary HTML and JavaScript. When completeHTMLDocument option is enabled, unescaped less-than and greater-than characters in markdown frontmatter metadata are inserted directly into HTML title tags, enabling attackers to break out of the title context and execute malicious scripts in the rendered page.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SH
showdown · showdown
through 2.1.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-59711
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-59711
github.com
https://github.com/showdownjs/showdown
github.com
https://github.com/showdownjs/showdown/issues/1047
www.vulncheck.com
https://www.vulncheck.com/advisories/showdown-cross-site-scripting-via-unescaped-metadata-title-in-completehtmldocument
More from showdown
6.1
CVE-2026-59710
showdown - Stored XSS via Unescaped Table Header ID Attribute Injection