CLEANSTART-2026-JB83386 issue in the anchors subparser of Showdownjs versions <= 2

Security vulnerability affects the n8n package. An issue in the anchors subparser of Showdownjs versions = 2...

CVE-2026-104477

Showdown through 2.1.0 contains a cross-site scripting vulnerability in the makehtml link and image subparsers, which fail to escape double quotes in destination URLs placed into href and src attributes. Attackers can craft markdown links or images containing a double quote followed by onerror or...

CVE-2026-104477: Improper Neutralization of Input During Web Page Generation

Showdown through 2.1.0 contains a cross-site scripting vulnerability in the makehtml link and image subparsers, which fail to escape double quotes in destination URLs placed into href and src attributes. Attackers can craft markdown links or images containing a double quote followed by onerror or...

CVE-2026-104477 Showdown through 2.1.0 XSS via unescaped quote in href and src attributes

Showdown through 2.1.0 contains a cross-site scripting vulnerability in the makehtml link and image subparsers, which fail to escape double quotes in destination URLs placed into href and src attributes. Attackers can craft markdown links or images containing a double quote followed by onerror or...

CVE-2026-104477

The Showdown library (versions through 2.1.0 ) is vulnerable to Cross-Site Scripting (XSS) due to a flaw in the makehtml link and image subparsers. The root cause is the failure to properly sanitize or escape double quotes in destination URLs when rendering HTML attributes like href and src. A re...

CVE-2026-104477 Showdown through 2.1.0 XSS via unescaped quote in href and src attributes

Showdown through 2.1.0 contains a cross-site scripting vulnerability in the makehtml link and image subparsers, which fail to escape double quotes in destination URLs placed into href and src attributes. Attackers can craft markdown links or images containing a double quote followed by onerror or...

CVE-2024-1899

An issue in the anchors subparser of Showdownjs versions = 2.1.0 could allow a remote attacker to cause denial of service conditions...

CVE-2024-1899

An issue in the anchors subparser of Showdownjs versions = 2.1.0 could allow a remote attacker to cause denial of service conditions...

Race condition

An issue in the anchors subparser of Showdownjs versions = 2.1.0 could allow a remote attacker to cause denial of service conditions...

CVE-2024-1899

CVE-2024-1899 affects ShowdownJS (the anchors subparser) where versions

CVE-2024-1899

An issue in the anchors subparser of Showdownjs versions = 2.1.0 could allow a remote attacker to cause denial of service conditions...

CVE-2024-1899 Showdownjs Denial of Service

An issue in the anchors subparser of Showdownjs versions = 2.1.0 could allow a remote attacker to cause denial of service conditions...

CVE-2024-1899 Showdownjs Denial of Service

An issue in the anchors subparser of Showdownjs versions = 2.1.0 could allow a remote attacker to cause denial of service conditions...

CVE-2024-1899: Uncontrolled Recursion

An issue in the anchors subparser of Showdownjs versions = 2.1.0 could allow a remote attacker to cause denial of service conditions...

PT-2024-18406

Name of the Vulnerable Software and Affected Versions Showdownjs versions = 2.1.0 Description An issue in the anchors subparser could allow a remote attacker to cause denial of service conditions. Recommendations For versions = 2.1.0, update to a version greater than 2.1.0 to resolve the issue. A...

Regular Expression Denial of Service (ReDoS)

Overview org.webjars.npm:showdown is a JavaScript Markdown to HTML converter. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS in the anchors subparser in anchors.js AKA links.js. PoC time node -e '/?:^|^\ ??:\n ?.?/g.test"".repeat9999' Details...