Reverse Tabnabbing in showdown

GHSA-h6mq-3cj6-h738

Published Sep 3, 2020 · Modified Oct 1, 2021

AI SAST

Find this class of vulnerability in your own code

Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.

Explore AI SAST Explore dependency scanning →

Description

Versions of showdown prior to 1.9.1 are vulnerable to Reverse Tabnabbing. The package uses target='_blank' in anchor tags, allowing attackers to access window.opener for the original page when opening links. This is commonly used for phishing attacks.

Recommendation

Upgrade to version 1.9.1 or later.

References

WEB https://github.com/showdownjs/showdown/pull/670
WEB https://github.com/showdownjs/showdown/commit/1cd281f0643ef613dc1d36847d4c6cbb22501d91
PACKAGE https://github.com/showdownjs/showdown
WEB https://snyk.io/vuln/SNYK-JS-SHOWDOWN-469487
WEB https://www.npmjs.com/advisories/1302

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes