CVE-2026-104477

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-104477
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104477.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-104477
Published
2026-10-02T23:28:47Z
Modified
2026-10-04T02:45:59Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
Showdown through 2.1.0 XSS via unescaped quote in href and src attributes
Details

Showdown through 2.1.0 contains a cross-site scripting vulnerability in the makehtml link and image subparsers, which fail to escape double quotes in destination URLs placed into href and src attributes. Attackers can craft markdown links or images containing a double quote followed by onerror or onmouseover handlers to execute script when victims view rendered HTML.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-79"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104477.json"
}
References

Affected packages

Git / github.com/showdownjs/showdown

Affected ranges

Type
GIT
Repo
https://github.com/showdownjs/showdown
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
9958ba5cfaf01c93ea9e1a48650fb3074eff98ce
Fixed
4fb992cd26631c108ec0410342630c80207ec7c6
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "2.1.0"
        }
    ],
    "source":  [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.4.0
0.5.0
0.5.1
1.*
1.0.0
1.0.0-alpha.2
1.0.0-alpha1
1.0.1
1.0.2
1.1.0
1.2.0
1.2.1
1.2.2
1.3.0
1.4.0
1.4.2
1.4.3
1.4.4
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.6.0
1.6.1
1.6.2
1.6.3
1.6.4
1.7.0
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5
1.7.6
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
1.9.0
1.9.1
2.*
2.0.0
2.0.0-alpha
2.0.1
2.0.2
2.0.3
2.0.4
v0.*
v0.3.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104477.json"