CVE-2026-104477 in Showdown
Summary
by MITRE • 10/03/2026
Showdown through 2.1.0 contains a cross-site scripting vulnerability in the makehtml link and image subparsers, which fail to escape double quotes in destination URLs placed into href and src attributes. Attackers can craft markdown links or images containing a double quote followed by onerror or onmouseover handlers to execute script when victims view rendered HTML.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/03/2026
The vulnerability identified in Showdown versions up through 2.1.0 represents a classic cross-site scripting flaw rooted in insufficient input sanitization within the library's markdown parsing engine. Specifically, this security defect resides in the implementation of the makehtml link and image subparsers, which are responsible for converting Markdown syntax into corresponding HTML elements such as anchor tags and img tags. When these parsers process user-supplied content that includes URLs or source paths, they fail to properly escape double quote characters present within those destination strings. This lack of proper encoding allows an attacker to break out of the expected attribute context by injecting a closing double quote followed by malicious event handler attributes directly into the href or src fields of the generated HTML markup.
From a technical perspective, this flaw is categorized under CWE-79, which defines Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting (XSS). The root cause lies in the failure to apply context-appropriate encoding rules when rendering dynamic content into static HTML structures. By inserting a double quote followed by an event handler such as onerror or onmouseover, an attacker can effectively inject arbitrary JavaScript code that executes within the victim's browser session. This exploitation vector relies on the assumption that the rendered markdown will be displayed in a context where these events trigger automatically or upon user interaction, allowing for the execution of malicious scripts without further user action beyond viewing the content.
The operational impact of this vulnerability is significant as it enables attackers to perform various unauthorized actions using the victim's identity and privileges within the application environment. Successful exploitation can lead to session hijacking through the theft of cookies or authentication tokens stored in local storage, redirection of users to phishing sites designed to steal credentials, defacement of web pages by altering DOM elements, or keylogging activities that capture sensitive information typed into forms. Because Showdown is often used as a client-side library for rendering user-generated content such as comments, forum posts, or documentation snippets, the attack surface is broad and affects any application integrating this specific version range without additional sanitization layers.
This vulnerability aligns with several tactics in the MITRE ATT&CK framework, particularly T1059 Command and Control via Application Layer Protocol if used for data exfiltration, but more directly it falls under techniques associated with client-side code injection such as DOM-based XSS which allows attackers to manipulate the Document Object Model dynamically. To mitigate this risk, developers should ensure they are using a version of Showdown greater than 2.1.0 where these parsing logic errors have been addressed. Additionally implementing Content Security Policy headers can provide an additional layer of defense by restricting the sources from which scripts can be loaded and executed. It is also advisable to employ server-side sanitization libraries that enforce strict output encoding rules before any user-supplied markdown content is rendered, ensuring that special characters like double quotes are consistently escaped regardless of the client-side library version in use.