showdown - Stored XSS via Unescaped Table Header ID Attribute Injection
cve-program · CVE-2026-59710
Publishedshowdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails to properly escape table header ID attributes. Attackers can inject arbitrary HTML and script-executing SVG elements through double-quote characters in markdown table headers, achieving stored XSS when untrusted markdown is rendered with the default github flavor configuration.
Read the publisher's advisoryeuvd · EUVD-2026-41954
Publishedshowdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails to properly escape table header ID attributes. Attackers can inject arbitrary HTML and script-executing SVG elements through double-quote characters in markdown table headers, achieving stored XSS when untrusted markdown is rendered with the default github flavor configuration.
Read the publisher's advisorynvd · CVE-2026-59710
Publishedshowdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails to properly escape table header ID attributes. Attackers can inject arbitrary HTML and script-executing SVG elements through double-quote characters in markdown table headers, achieving stored XSS when untrusted markdown is rendered with the default github flavor configuration.
Read the publisher's advisoryosv · GHSA-22g5-r2x5-97cx
Publishedshowdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails to properly escape table header ID attributes. Attackers can inject arbitrary HTML and script-executing SVG elements through double-quote characters in markdown table headers, achieving stored XSS when untrusted markdown is rendered with the default github flavor configuration.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-59710 · CVE overview and exploitation status
cve-program · CVE-2026-59710
- https://github.com/showdownjs/showdown/issues/1046
- https://github.com/showdownjs/showdown
- https://github.com/showdownjs/showdown/commit/e5cab1e9a5dcea2bb3cbf888863fa7e65ab37edf
- https://www.vulncheck.com/advisories/showdown-stored-xss-via-unescaped-table-header-id-attribute-injection
euvd · EUVD-2026-41954
- https://github.com/showdownjs/showdown/issues/1046
- https://github.com/showdownjs/showdown
- https://github.com/showdownjs/showdown/commit/e5cab1e9a5dcea2bb3cbf888863fa7e65ab37edf
- https://www.vulncheck.com/advisories/showdown-stored-xss-via-unescaped-table-header-id-attribute-injection
nvd · CVE-2026-59710
- https://github.com/showdownjs/showdown
- https://github.com/showdownjs/showdown/commit/e5cab1e9a5dcea2bb3cbf888863fa7e65ab37edf
- https://github.com/showdownjs/showdown/issues/1046
- https://www.vulncheck.com/advisories/showdown-stored-xss-via-unescaped-table-header-id-attribute-injection
osv · GHSA-22g5-r2x5-97cx
- https://nvd.nist.gov/vuln/detail/CVE-2026-59710
- https://github.com/showdownjs/showdown/issues/1046
- https://github.com/showdownjs/showdown/commit/e5cab1e9a5dcea2bb3cbf888863fa7e65ab37edf
- https://github.com/showdownjs/showdown
- https://www.vulncheck.com/advisories/showdown-stored-xss-via-unescaped-table-header-id-attribute-injection
Related changes
Linked by CVE identifierNo related changes are available here.