Showdown contains a cross‑site scripting flaw where unescaped < and > characters in markdown frontmatter metadata are inserted directly into the HTML title tag when the completeHTMLDocument option is enabled. This allows an attacker to break out of the title context and inject arbitrary HTML or JavaScript that is executed in the rendered page. The weakness is a classic injection issue classified as CWE‑79 and is restricted to client‑side code, meaning it is triggered by rendering rather than by server‑side logic.

Any Node.js application that incorporates the Showdown library (showdownjs/showdown) and renders Markdown with the completeHTMLDocument option enabled may be affected. All versions of Showdown that implement the unescaped title handling logic are vulnerable; the CVE payload does not provide specific version ranges, so affected instances must be confirmed by inspecting the library code or its commit history.

The CVSS score of 5.3 indicates moderate severity. The EPSS score of less than 1% suggests a low likelihood of exploitation in the near term, and the vulnerability is not listed in CISA's KEV catalog. The attack vector is client‑side: an attacker can supply crafted markdown frontmatter containing malicious title content that is rendered with completeHTMLDocument enabled in a web browser or other client rendering the Markdown. Successful exploitation results in arbitrary script execution in the context of the page.