Showdown is vulnerable to a cross‑site scripting flaw where unescaped < and > characters in markdown frontmatter metadata are inserted directly into an HTML title element when the completeHTMLDocument option is enabled. This allows an attacker to inject arbitrary HTML or JavaScript that executes in the context of the rendered page, potentially compromising the confidentiality and integrity of information displayed to users. The weakness is a classic injection issue classified as CWE‑79 and is restricted to client‑side code, meaning it is triggered by rendering rather than by server‑side logic.

Any Node.js application that incorporates the Showdown library and renders Markdown with the completeHTMLDocument option enabled is potentially affected. The vulnerability is present in all library versions that contain the unescaped title handling logic; specific version ranges are not supplied, so affected instances must be confirmed by inspecting the library code or its commit history.

The CVSS score of 5.3 indicates moderate severity. The EPSS score of less than 1% suggests a low likelihood of exploitation in the near term, and the vulnerability is not listed in CISA's KEV catalog. The attack vector is likely a web application that accepts or renders user‑supplied Markdown; an attacker must supply crafted frontmatter containing malicious title content processed with completeHTMLDocument enabled to trigger the XSS.