CVE-2026-59710: showdown allows stored cross-site scripting through table header ID injection
(updated )
showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails to properly escape table header ID attributes. Attackers can inject arbitrary HTML and script-executing SVG elements through double-quote characters in markdown table headers, achieving stored XSS when untrusted markdown is rendered with the default github flavor configuration.
References
- github.com/advisories/GHSA-22g5-r2x5-97cx
- github.com/showdownjs/showdown
- github.com/showdownjs/showdown/commit/e5cab1e9a5dcea2bb3cbf888863fa7e65ab37edf
- github.com/showdownjs/showdown/issues/1046
- nvd.nist.gov/vuln/detail/CVE-2026-59710
- www.vulncheck.com/advisories/showdown-stored-xss-via-unescaped-table-header-id-attribute-injection
Code Behaviors & Features
Detect and mitigate CVE-2026-59710 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →