CVE-2026-59710 — showdown - Stored XSS via Unescaped Table Header ID Attribute Injection
showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails to properly escape table header ID att…
Published: 2026-07-06 · CVSS: 5.3 · CVSS 4.0
showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails to properly escape table header ID attributes. Attackers can inject arbitrary HTML and script-executing SVG elements through double-quote characters in markdown table headers, achieving stored XSS when untrusted markdown is rendered with the default github flavor configuration.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7