CVE-2026-59711: Showdown Markdown XSS Vulnerability

CVE-2026-59711 Overview

CVE-2026-59711 is a cross-site scripting (XSS) vulnerability in the Showdown Markdown-to-HTML converter. The flaw resides in how Showdown processes frontmatter metadata when the completeHTMLDocument option is enabled. Unescaped < and > characters supplied through the metadata title field are inserted directly into the HTML <title> element of the rendered document. Attackers can break out of the title context and inject arbitrary HTML and JavaScript that executes in the victim's browser. The issue is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Attackers who can supply markdown content with crafted frontmatter can execute arbitrary JavaScript in the context of any application rendering that content with completeHTMLDocument enabled.

Affected Products

Showdown JavaScript Markdown-to-HTML converter (all versions with completeHTMLDocument support)
Web applications embedding Showdown for user-submitted markdown rendering
Static site generators and documentation tools built on Showdown

Discovery Timeline

2026-07-06 - CVE-2026-59711 published to the National Vulnerability Database
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-59711

Vulnerability Analysis

Showdown supports YAML-style frontmatter for markdown documents. When the completeHTMLDocument option is enabled, Showdown emits a full HTML document and uses the title field from the frontmatter to populate the <title> tag. The converter fails to HTML-encode the raw characters within the title value before inserting them into the output document.

Because < and > pass through without escaping, an attacker who controls the markdown source can terminate the <title> element early. After closing the tag, the attacker can inject arbitrary HTML, including <script> blocks or event handler payloads. Any application that renders untrusted markdown with this option enabled propagates the injected content directly to end users.

Root Cause

The root cause is missing output encoding in the metadata rendering path. Showdown treats the title frontmatter field as trusted text rather than untrusted user input requiring HTML entity encoding. The converter applies encoding to body content in several code paths but omits equivalent handling when substituting metadata values into the document template.

Attack Vector

The attack requires an application that accepts markdown input from an untrusted source and renders it with completeHTMLDocument set to true. The attacker submits a markdown document containing frontmatter with a crafted title value that includes </title> followed by malicious HTML or script content. When the target application converts the markdown and serves the resulting HTML, the injected payload executes in the victim's browser session. See the VulnCheck Showdown XSS Advisory and GitHub Issue #1047 Discussion for additional technical detail.

Detection Methods for CVE-2026-59711

Indicators of Compromise

Markdown documents containing frontmatter title values with <, >, or </title> sequences.
Rendered HTML pages where the <title> element contains script tags, event handlers, or unexpected nested elements.
Web application logs showing markdown uploads with YAML frontmatter blocks and angle brackets in metadata fields.

Detection Strategies

Scan repositories and content stores for markdown files whose frontmatter title field contains HTML control characters.
Add web application firewall (WAF) rules that inspect submitted markdown payloads for title: values containing < or >.
Perform regression tests that submit crafted frontmatter payloads against staging endpoints and inspect the rendered HTML for injected script tags.

Monitoring Recommendations

Monitor client-side Content Security Policy (CSP) violation reports for inline script executions on pages generated by Showdown.
Log Showdown converter invocations and capture the value of the completeHTMLDocument option and frontmatter fields for later review.
Alert on outbound requests initiated from rendered pages to domains not on an allowlist, which can indicate successful script injection.

How to Mitigate CVE-2026-59711

Immediate Actions Required

Disable the completeHTMLDocument option in Showdown configurations that process untrusted markdown until a patched version is deployed.
Sanitize markdown input server-side to strip or encode < and > characters within frontmatter metadata fields.
Apply a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.

Patch Information

Refer to the Showdown GitHub repository and GitHub Issue #1047 Discussion for the current patch status and upgrade guidance. Upgrade to the fixed release once available and re-enable completeHTMLDocument only after verifying that metadata values are HTML-encoded in the output.

Workarounds

Pipe Showdown output through an HTML sanitizer such as DOMPurify before serving it to users.
Wrap Showdown invocations with a preprocessor that HTML-encodes the title frontmatter value before conversion.
Serve rendered markdown from a sandboxed origin with a restrictive CSP header, preventing script execution regardless of injected content.

bash

# Configuration example: disable completeHTMLDocument when handling untrusted input
const showdown = require('showdown');
const converter = new showdown.Converter({
  metadata: true,
  completeHTMLDocument: false
});
const html = converter.makeHtml(untrustedMarkdown);