Bug 2497535 (CVE-2026-59711)

Summary:	CVE-2026-59711 showdown: Showdown: Cross-site scripting via unescaped metadata title allows arbitrary code execution
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aazores, akhatavk, akostadi, amasferr, aos-team-art-private, aruklets, asdas, bdettelb, cmah, dkeler, dmayorov, doconnor, dpaolell, dschmidt, eaguilar, ebaron, gparvin, jdelft, jkoehler, jlanda, jlledo, jmatsuok, jolong, jtolenti, jupierce, kshier, lgarciaa, lphiri, mbiarnes, pantinor, pjindal, ppalepu, ppostler, prdhamdh, rhaigner, sghai, sidsharm, simaishi, stcannon, suppawar, teagle, thason, tsedmik, vlaad, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in showdown. This cross-site scripting (XSS) vulnerability occurs in the metadata title handling when the `completeHTMLDocument` option is enabled. An attacker can exploit this by injecting unescaped less-than and greater-than characters into markdown frontmatter metadata. This allows the attacker to break out of the HTML title context and execute arbitrary HTML and JavaScript, potentially leading to information disclosure or arbitrary code execution in the user's browser.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2531306
Bug Blocks:

Description OSIDB Bzimport 2026-07-06 22:01:56 UTC

showdown contains a cross-site scripting vulnerability in metadata title handling that allows attackers to inject arbitrary HTML and JavaScript. When completeHTMLDocument option is enabled, unescaped less-than and greater-than characters in markdown frontmatter metadata are inserted directly into HTML title tags, enabling attackers to break out of the title context and execute malicious scripts in the rendered page.