GHSA-h6mq-3cj6-h738

Source

https://github.com/advisories/GHSA-h6mq-3cj6-h738

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-h6mq-3cj6-h738/GHSA-h6mq-3cj6-h738.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-h6mq-3cj6-h738

Published

2020-09-03T23:21:16Z

Modified

2021-10-01T16:12:36Z

Severity

3.1 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N CVSS Calculator

Summary

Reverse Tabnabbing in showdown

Details

Versions of showdown prior to 1.9.1 are vulnerable to Reverse Tabnabbing. The package uses target='_blank' in anchor tags, allowing attackers to access window.opener for the original page when opening links. This is commonly used for phishing attacks.

Recommendation

Upgrade to version 1.9.1 or later.

Database specific

{
    "cwe_ids":  [
        "CWE-1022"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-08-31T18:54:24Z",
    "nvd_published_at":  null,
    "severity":  "LOW"
}

References

Affected packages

npm / showdown

Package

Name: showdown; View open source insights on deps.dev
Purl: pkg:npm/showdown

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.9.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-h6mq-3cj6-h738/GHSA-h6mq-3cj6-h738.json"