{"id":"EUVD-2026-41948","revision":"834361c1ff8749f6a7a6a538065bc6a7","records":[{"revision":"834361c1ff8749f6a7a6a538065bc6a7","observedAt":"2026-11-03T12:01:00.177+00:00","statement":{"source":"euvd","id":"EUVD-2026-41948","aliases":["CVE-2026-59711","GHSA-cr32-g25g-vxjj"],"title":"showdown contains a cross-site scripting vulnerability in metadata title handling that allows attackers to inject arbitrary HTML and JavaScript. When completeHTMLDocument option is enabled, unescaped less-than and greater-than characters in…","description":"showdown contains a cross-site scripting vulnerability in metadata title handling that allows attackers to inject arbitrary HTML and JavaScript. When completeHTMLDocument option is enabled, unescaped less-than and greater-than characters in markdown frontmatter metadata are inserted directly into HTML title tags, enabling attackers to break out of the title context and execute malicious scripts in the rendered page.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","score":5.3,"severity":null}],"references":["https://github.com/showdownjs/showdown/issues/1047","https://github.com/showdownjs/showdown","https://www.vulncheck.com/advisories/showdown-cross-site-scripting-via-unescaped-metadata-title-in-completehtmldocument"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-41948","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jul 6, 2026, 9:00:38 PM","dateUpdated":"Jul 7, 2026, 2:06:55 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-41948","identifiers":["EUVD-2026-41948","CVE-2026-59711","GHSA-cr32-g25g-vxjj"]},"retained":false,"historicalAffected":[]}],"coverage":[]}