GitHub Advisoryadvisory · npm

GHSA-22g5-r2x5-97cx showdown allows stored cross-site scripting through table header ID injection

MEDIUM Published 2026-07-07 Modified 2026-08-07 Official page ↗
Aliases
CVE-2026-59710
Ecosystem
npm
Packages
showdown
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2026-08-07

Affected packages

• npm showdown: <= 2.1.0 (no fix yet)

Description

showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails to properly escape table header ID attributes. Attackers can inject arbitrary HTML and script-executing SVG elements through double-quote characters in markdown table headers, achieving stored XSS when untrusted markdown is rendered with the default github flavor configuration.

Related

Alias · CVE (1)

  • CVE-2026-59710 showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References