CVE-2026-59710

Name of the Vulnerable Software and Affected Versions showdown (affected versions not specified)

Description A stored cross-site scripting issue exists in the parseHeaders() function within src/subParsers/makehtml/tables.js. The software fails to properly escape table header ID attributes, allowing attackers to inject arbitrary HTML and script-executing SVG elements using double-quote characters in markdown table headers. This occurs when untrusted markdown is rendered using the default github flavor configuration.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.