Reverse Tabnabbing in showdown

GHSA-h6mq-3cj6-h738

Published Sep 3, 2020 · Modified Oct 1, 2021

Description

Versions of showdown prior to 1.9.1 are vulnerable to Reverse Tabnabbing. The package uses target='_blank' in anchor tags, allowing attackers to access window.opener for the original page when opening links. This is commonly used for phishing attacks.

Recommendation

Upgrade to version 1.9.1 or later.

References

WEB https://github.com/showdownjs/showdown/pull/670
WEB https://github.com/showdownjs/showdown/commit/1cd281f0643ef613dc1d36847d4c6cbb22501d91
PACKAGE https://github.com/showdownjs/showdown
WEB https://snyk.io/vuln/SNYK-JS-SHOWDOWN-469487
WEB https://www.npmjs.com/advisories/1302

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes