~ / search / GHSA-22g5-r2x5-97cx

GHSA-22g5-r2x5-97cx

showdown allows stored cross-site scripting through table header ID injection

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-59710

Packages

EcosystemPackageAffectedFixed in
npm showdown <= 2.1.0 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails to properly escape table header ID attributes. Attackers can inject arbitrary HTML and script-executing SVG elements through double-quote characters in markdown table headers, achieving stored XSS when untrusted markdown is rendered with the default github flavor configuration.

References

External links from the advisory. They lead to third-party sites.