Reverse Tabnabbing Vulnerability in showdown
Summary
GHSA-h6mq-3cj6-h738: Reverse Tabnabbing in showdown. Affects showdown versions < 1.9.1. Fixed in 1.9.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
showdown is an open-source JavaScript library that converts Markdown text into HTML. It is commonly used in web applications to render user-generated content. The library allows users to write Markdown syntax and converts it into HTML for display. However, versions prior to 1.9.1 are vulnerable to a security issue known as Reverse Tabnabbing.
Vulnerability Detail
The Reverse Tabnabbing vulnerability occurs when the showdown package uses target='_blank' in anchor tags. This allows attackers to access the window.opener object of the original page when opening links. Attackers can exploit this vulnerability to perform phishing attacks, tricking users into interacting with a malicious page that appears to be from a trusted source. This can lead to the theft of sensitive information or the execution of unauthorized actions.
How To Fix
Minimum fixed version
1.9.1
This is the first release that contains the fix.
npm install showdown@1.9.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of the showdown package to mitigate the risk.
Conclusion
The Reverse Tabnabbing vulnerability in the showdown package prior to version 1.9.1 can be exploited by attackers to perform phishing attacks and steal sensitive information. To mitigate this risk, it is recommended to upgrade to version 1.9.1 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for showdown →
FAQ
Reverse Tabnabbing is a type of attack where a malicious website can manipulate the window.opener object of a page opened in a new tab or window. By exploiting this vulnerability, attackers can trick users into interacting with a malicious page that appears to be from a trusted source.
Attackers can exploit the Reverse Tabnabbing vulnerability in showdown by crafting Markdown content that includes links with target='_blank'. When users click on these links, the attacker's page can access the window.opener object and potentially perform unauthorized actions or steal sensitive information.
The impact of this vulnerability can be significant. Attackers can use Reverse Tabnabbing to conduct phishing attacks, tricking users into interacting with malicious pages that appear legitimate. This can lead to the theft of sensitive information, such as login credentials or financial data.
Yes, upgrading to version 1.9.1 or later of the showdown package fixes the Reverse Tabnabbing vulnerability. The fix adds the rel='noopener noreferrer' attribute to anchor tags with target='_blank', preventing the attacker's page from accessing the window.opener object.
There are no known workarounds for this vulnerability. It is crucial to upgrade to the fixed version of the showdown package to protect against Reverse Tabnabbing attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for showdown.
