WS-2019-0319

In "showdownjs/showdown" prior to v1.9.1, 'rel="noopener' is not defined, thus can lead an attacker to control the document’s window object...