CyberRota Analysis
AI-GeneratedA cross-site scripting vulnerability exists in the metadata title handling of Java's showdown library, allowing attackers to inject arbitrary HTML and JavaScript when the completeHTMLDocument option is enabled. This flaw can lead to the execution of malicious scripts in rendered pages, potentially compromising user data and session integrity. Developers and organizations utilizing the showdown library should prioritize patching this vulnerability to mitigate the risks associated with XSS attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
showdown contains a cross-site scripting vulnerability in metadata title handling that allows attackers to inject arbitrary HTML and JavaScript. When completeHTMLDocument option is enabled, unescaped less-than and greater-than characters in markdown frontmatter metadata are inserted directly into HTML title tags, enabling attackers to break out of the title context and execute malicious scripts in the rendered page.