A flaw was found in showdown. The link and image parsers fail to properly sanitize or escape double quotation marks in destination URLs when rendering HTML attributes. A remote attacker could exploit this flaw by supplying crafted Markdown input containing malicious event handlers, leading to Cross-Site Scripting (XSS) and executing arbitrary script in the context of the victim's browser session.
Last checked: 2026-10-03 02:32 UTC
Fix evidence last checked: 2026-10-03 00:59 UTC