MEDIUM 6.1

GHSA-22g5-r2x5-97cx

showdown allows stored cross-site scripting through table header ID injection

Details

showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails to properly escape table header ID attributes. Attackers can inject arbitrary HTML and script-executing SVG elements through double-quote characters in markdown table headers, achieving stored XSS when untrusted markdown is rendered with the default github flavor configuration.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm / showdown

Introduced in: 0

No fixed version published yet for showdown (npm). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-59710 [ADVISORY]
https://github.com/showdownjs/showdown/issues/1046 [WEB]
https://github.com/showdownjs/showdown/commit/e5cab1e9a5dcea2bb3cbf888863fa7e65ab37edf [WEB]
https://github.com/showdownjs/showdown [PACKAGE]
https://www.vulncheck.com/advisories/showdown-stored-xss-via-unescaped-table-header-id-attribute-injection [WEB]