GHSA-h6mq-3cj6-h738 Reverse Tabnabbing in showdown
Attackers can exploit reverse tabnabbing in showdown to access the original page's window object, facilitating phishing attacks against users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-h6mq-3cj6-h738?
GHSA-h6mq-3cj6-h738 is a vulnerability in showdown, published on 3 Sep 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Versions of showdown prior to 1.9.1 are vulnerable to Reverse Tabnabbing. The package uses target='_blank' in anchor tags, allowing attackers to access window.opener for the original page when opening links. This is commonly used for phishing attacks.
Recommendation
Upgrade to version 1.9.1 or later.
Which versions are affected by GHSA-h6mq-3cj6-h738?
2 open source packages ship an affected version, including showdown.
| Package | Affected | Fixed in |
|---|---|---|
showdown npm | All versions | 1.9.1 |
showdown npm | All versions | 1.9.1 |
How do I fix GHSA-h6mq-3cj6-h738?
Upgrade showdown to 1.9.1 or later.
Is GHSA-h6mq-3cj6-h738 being exploited?
There is no known exploitation of GHSA-h6mq-3cj6-h738 in the wild and no public exploit code.