What is GHSA-h6mq-3cj6-h738?

GHSA-h6mq-3cj6-h738 is a security advisory published by GitHub Security Advisories with Low severity. Reverse Tabnabbing in showdown

Why does GHSA-h6mq-3cj6-h738 have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

What is the CVSS v3 score of GHSA-h6mq-3cj6-h738?

GHSA-h6mq-3cj6-h738 has a CVSS v3 base score of 3.1, published by GitHub Security Advisories.

Which products are affected by GHSA-h6mq-3cj6-h738?

GHSA-h6mq-3cj6-h738 affects 1 product, including: npm/showdown:\u003c 1.9.1.

GHSA-h6mq-3cj6-h738LowCVSS 3.1Disclosed before NVD

Reverse Tabnabbing in showdown

Vendor

GitHub Security Advisories

Published

September 3, 2020

Last Modified

April 5, 2023

📋 Description

Versions of showdown prior to 1.9.1 are vulnerable to Reverse Tabnabbing. The package uses target='_blank' in anchor tags, allowing attackers to access window.opener for the original page when opening links. This is commonly used for phishing attacks.

Recommendation

Upgrade to version 1.9.1 or later.

🎯 Affected products1

npm/showdown:< 1.9.1

🔗 References (5)

https://snyk.io/vuln/SNYK-JS-SHOWDOWN-469487
https://www.npmjs.com/advisories/1302
https://github.com/showdownjs/showdown/pull/670
https://github.com/showdownjs/showdown/commit/1cd281f0643ef613dc1d36847d4c6cbb22501d91
https://github.com/advisories/GHSA-h6mq-3cj6-h738