All the vulnerabilities related to the version 1.4.1 of the package
Reverse Tabnabbing in showdown
Versions of showdown
prior to 1.9.1 are vulnerable to Reverse Tabnabbing. The package uses target='_blank'
in anchor tags, allowing attackers to access window.opener
for the original page when opening links. This is commonly used for phishing attacks.
Upgrade to version 1.9.1 or later.