Vc-Smoore

**Name of the Vulnerable Software and Affected Versions** showdown (affected versions not specified) **Description** An issue exists in metadata title handling that allows the injection of arbitrary HTML and JavaScript. When the `completeHTMLDocument` option is enabled, unescaped less-than and greater-than characters in markdown frontmatter metadata are inserted directly into HTML title tags. This allows attackers to break out of the title context and execute malicious scripts in the rendered page. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** showdown (affected versions not specified) **Description** A stored cross-site scripting issue exists in the `parseHeaders()` function within `src/subParsers/makehtml/tables.js`. The software fails to properly escape table header ID attributes, allowing attackers to inject arbitrary HTML and script-executing SVG elements using double-quote characters in markdown table headers. This occurs when untrusted markdown is rendered using the default github flavor configuration. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.