Read the docs

Showdownjs

Records2All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9

Exploited now

Showdownjs records in CISA KEV

No Showdownjs vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Showdown 1 record MEDIUM

Records

2 records

TI-2024-01768 CVE-2024-1899 · GHSA-rmmh-p597-ppvv

Showdownjs Denial of Service

Priority MEDIUM 63

An issue in the anchors subparser of Showdownjs versions <= 2.1.0 could allow a remote attacker to cause denial of service conditions.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00806 Published 2024-02-26 No fix listed CWE-674
TI-2026-67388 CVE-2026-104477 · GHSA-gc85-xrjc-cv75

Showdown through 2.1.0 XSS via unescaped quote in href and src attributes

Priority LOW 29

Showdown through 2.1.0 contains a cross-site scripting vulnerability in the makehtml link and image subparsers, which fail to escape double quotes in destination URLs placed into href and src attributes.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00187 Published 2026-10-02 Fix deferred CWE-79
Open these records in search →