Stored XSS in Showdown Markdown Parser via Table Headers

Publication date: 2026-07-06

Last updated on: 2026-07-06

Assigner: VulnCheck

Description

showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails to properly escape table header ID attributes. Attackers can inject arbitrary HTML and script-executing SVG elements through double-quote characters in markdown table headers, achieving stored XSS when untrusted markdown is rendered with the default github flavor configuration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-06

Last Modified

2026-07-06

Generated

2026-07-07

AI Q&A

2026-07-07

EPSS Evaluated

N/A

NVD

CVE-2026-59710

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the showdown library, specifically in the parseHeaders function of the file src/subParsers/makehtml/tables.js. It is a stored cross-site scripting (XSS) vulnerability caused by the failure to properly escape table header ID attributes.

Attackers can exploit this by injecting arbitrary HTML and script-executing SVG elements through double-quote characters in markdown table headers. When untrusted markdown is rendered using the default github flavor configuration, this leads to stored XSS.

Impact Analysis

The vulnerability allows attackers to execute arbitrary scripts in the context of the affected application by injecting malicious code into markdown table headers.

This can lead to stored cross-site scripting attacks, which may result in unauthorized actions performed on behalf of users, theft of sensitive information such as cookies or session tokens, and potential compromise of user accounts.

Hi! I’m here to help you understand CVE-2026-59710. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70