CVE-2026-59710
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A stored cross-site scripting vulnerability exists in the showdown library's parseHeaders function in src/subParsers/makehtml/tables.js, which fails to properly escape table header ID attributes. Attackers can inject arbitrary HTML and script-executing SVG elements via double-quote characters in Markdown table headers, achieving stored XSS when untrusted Markdown is rendered with the default GitHub flavor configuration.
Risk Assessment
The risk is that an attacker can inject malicious scripts that execute in the victim's browser when untrusted Markdown is rendered with the default GitHub flavor configuration. This could lead to session theft, account takeover, or data leakage.
Recommendation
Immediately update the showdown library to the latest version that includes a fix for CVE-2026-59710. If an update is not possible, avoid rendering untrusted Markdown with the default GitHub flavor configuration.
Other vulnerabilities in showdown
See all- CVE-2026-104477Medium
Showdown through 2.1.0 contains a cross-site scripting vulnerability in the makehtml link and image subparsers, which fail to escape double quotes in destination URLs placed into href and src attributes. Attackers can craft markdown links or images containing a double quote followed by onerror or onmouseover handlers to execute script when victims view rendered HTML.
- CVE-2026-59711Medium
The showdown library contains a cross-site scripting vulnerability in metadata title handling. When the completeHTMLDocument option is enabled, unescaped less-than and greater-than characters in markdown frontmatter metadata are inserted directly into HTML title tags, allowing attackers to inject arbitrary HTML and JavaScript.
Original NVD description (English source)
showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails to properly escape table header ID attributes. Attackers can inject arbitrary HTML and script-executing SVG elements through double-quote characters in markdown table headers, achieving stored XSS when untrusted markdown is rendered with the default github flavor configuration.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS