CVE-2026-59710
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A stored cross-site scripting vulnerability exists in the showdown library's parseHeaders function in src/subParsers/makehtml/tables.js, which fails to properly escape table header ID attributes. Attackers can inject arbitrary HTML and script-executing SVG elements via double-quote characters in Markdown table headers, achieving stored XSS when untrusted Markdown is rendered with the default GitHub flavor configuration.
Risk Assessment
The risk is that an attacker can inject malicious scripts that execute in the victim's browser when untrusted Markdown is rendered with the default GitHub flavor configuration. This could lead to session theft, account takeover, or data leakage.
Recommendation
Immediately update the showdown library to the latest version that includes a fix for CVE-2026-59710. If an update is not possible, avoid rendering untrusted Markdown with the default GitHub flavor configuration.
Original NVD description (English source)
showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails to properly escape table header ID attributes. Attackers can inject arbitrary HTML and script-executing SVG elements through double-quote characters in markdown table headers, achieving stored XSS when untrusted markdown is rendered with the default github flavor configuration.