GHSA-cr32-g25g-vxjj is a medium-severity (CVSS 6.1) Cross-site Scripting (XSS) vulnerability in showdown. No vendor fix is recorded yet; mitigation options are listed below.
showdown metadata title handling allows cross-site scripting
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
Exploitation and automatability from CISA’s SSVC triage for GHSA-cr32-g25g-vxjj.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
GHSA-cr32-g25g-vxjj by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 382,205 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
showdownnpmDescription
showdown contains a cross-site scripting vulnerability in metadata title handling that allows attackers to inject arbitrary HTML and JavaScript. When completeHTMLDocument option is enabled, unescaped less-than and greater-than characters in markdown frontmatter metadata are inserted directly into HTML title tags, enabling attackers to break out of the title context and execute malicious scripts in the rendered page.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | showdown | all versions | No fix |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for showdown, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Remediation status
No patched version of showdown has shipped for GHSA-cr32-g25g-vxjj yet. Where your build allows, override or pin the dependency away from the vulnerable range, and apply any maintainer-recommended mitigation.
Mitigate without a patch
Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
Red Hat rates this flaw as Moderate. Exploitation requires two non-default showdown options enabled simultaneously: metadata and completeHTMLDocument, both of which default to false. Red Hat products that ship showdown do not enable completeHTMLDocument in their default configurations, which reduces the likelihood of…
Do not enable showdown's completeHTMLDocument option when processing untrusted markdown input. If the option is required, sanitize metadata values before passing them to the converter.Source: Red Hat security advisory for GHSA-cr32-g25g-vxjj (CC BY 4.0)
Frequently Asked Questions
Is GHSA-cr32-g25g-vxjj in your dependencies?
Find it across npm, including transitive dependencies.