In breve
- CVE-2026-59710 è una vulnerabilità MEDIO (CVSS 6.1) che riguarda showdown.
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.34%, superiore al 27.4% delle vulnerabilità.
- Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.
| Package | Affected versions | Patched versions |
|---|
| showdown npm | ≤ 2.1.0
| No fix yet |
Description
showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails to properly escape table header ID attributes. Attackers can inject arbitrary HTML and script-executing SVG elements through double-quote characters in markdown table headers, achieving stored XSS when untrusted markdown is rendered with the default github flavor configuration.
NVD description
showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails to properly escape table header ID attributes. Attackers can inject arbitrary HTML and script-executing SVG elements through double-quote characters in markdown table headers, achieving stored XSS when untrusted markdown is rendered with the default github flavor configuration.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free