A flaw was found in showdown. The link and image parsers fail to properly sanitize or escape double quotation marks in destination URLs when rendering HTML attributes. A remote attacker could exploit this flaw by supplying crafted Markdown input containing malicious event handlers, leading to Cross-Site Scripting (XSS) and executing arbitrary script in the context of the victim's browser session.
Last checked: 2026-10-06 16:33 UTC
No exploitation evidence · CISA Coordinator (Assessed 2026-10-05 19:42 UTC)
Fix evidence last checked: 2026-10-05 18:16 UTC