CVE-2026-59710: showdown - Stored XSS via Unescaped Table Header ID Attribute Injection

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-06 · updated 2026-07-07
Weakness: CWE-79

Description

showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails to properly escape table header ID attributes. Attackers can inject arbitrary HTML and script-executing SVG elements through double-quote characters in markdown table headers, achieving stored XSS when untrusted markdown is rendered with the default github flavor configuration.

Affected products

showdown: through 2.1.0

References

https://github.com/showdownjs/showdown
https://github.com/showdownjs/showdown/commit/e5cab1e9a5dcea2bb3cbf888863fa7e65ab37edf
https://github.com/showdownjs/showdown/issues/1046
https://www.vulncheck.com/advisories/showdown-stored-xss-via-unescaped-table-header-id-attribute-injection
https://github.com/showdownjs/showdown/issues/1046

Get alerted when CVE-2026-59710 or the next vulnerability affects your stack