Stored Cross-Site Scripting Vulnerability in Showdown by ShowdownJS

CVE-2026-59710

What is CVE-2026-59710?

A stored cross-site scripting vulnerability exists in Showdown's markdown parsing feature. This flaw occurs in the parseHeaders function, particularly due to improper escaping of table header ID attributes. By exploiting this vulnerability, attackers can inject malicious HTML and executable SVG elements through crafted markdown table headers. When such untrusted markdown is rendered under the default GitHub flavor configuration, it could lead to the execution of arbitrary scripts, compromising the security of user data and applications reliant on this library.

References