CVE-2026-59711

Name of the Vulnerable Software and Affected Versions showdown (affected versions not specified)

Description An issue exists in metadata title handling that allows the injection of arbitrary HTML and JavaScript. When the completeHTMLDocument option is enabled, unescaped less-than and greater-than characters in markdown frontmatter metadata are inserted directly into HTML title tags. This allows attackers to break out of the title context and execute malicious scripts in the rendered page.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.