Reverse Tabnabbing in showdown

published 2020-09-03 6y ago modified 2021-10-01 5y ago

cvss: 3.1; version 3.1, GitHub
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

Versions of `showdown` prior to 1.9.1 are vulnerable to [Reverse Tabnabbing](https://www.owasp.org/index.php/Reverse_Tabnabbing). The package uses `target='_blank'` in anchor tags, allowing attackers to access `window.opener` for the original page when opening links. This is commonly used for phishing attacks.

## Recommendation

Upgrade to version 1.9.1 or later.

Patch / fix

fixed in 1 links 2

npm showdown 1.9.1

github.com/showdownjs/showdown@1cd281f commit
github.com/showdownjs/showdown#670 pull request

Is GHSA-h6mq-3cj6-h738 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CVSS scores

assigned by	version	score	vector
GitHub	3.1	3.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Affected packages

ecosystem	package	affected	fixed in
npm	showdown	<1.9.1	1.9.1

Classification

Weakness

CWE-1022 Use of Web Link to Untrusted Target with window.opener Access

References

Sources

GitHub Advisory GHSA-h6mq-3cj6-h738

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.