CVE-2026-59711
1 advisory.
npm/showdown CVE-2026-59711: medium 6.1, EPSS 0.33%
showdown metadata title handling allows cross-site scripting
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 2.1.0 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-cr32-g25g-vxjj
- https://nvd.nist.gov/vuln/detail/CVE-2026-59711
- https://github.com/showdownjs/showdown/issues/1047
- https://github.com/showdownjs/showdown/commit/184a3e4e97f90e075c4512f2c4c06dcf655e91b7
- https://github.com/showdownjs/showdown
- https://www.vulncheck.com/advisories/showdown-cross-site-scripting-via-unescaped-metadata-title-in-completehtmldocument
CVE-2026-59711 · published · modified · JSON