En bref
- CVE-2026-59710 est une vulnérabilité MOYENNE (CVSS 6.1) touchant showdown.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.34%, plus élevée que 27.4% des vulnérabilités.
- Aucune version corrigée n'est encore connue : suivez l'avis de l'éditeur dans les références.
| Package | Affected versions | Patched versions |
|---|
| showdown npm | ≤ 2.1.0
| No fix yet |
Description
showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails to properly escape table header ID attributes. Attackers can inject arbitrary HTML and script-executing SVG elements through double-quote characters in markdown table headers, achieving stored XSS when untrusted markdown is rendered with the default github flavor configuration.
NVD description
showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails to properly escape table header ID attributes. Attackers can inject arbitrary HTML and script-executing SVG elements through double-quote characters in markdown table headers, achieving stored XSS when untrusted markdown is rendered with the default github flavor configuration.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free