CVE-2026-59710

A flaw was found in Showdown. This vulnerability, a stored cross-site scripting XSS issue, allows an attacker to inject malicious code into web pages. By exploiting unescaped table header ID attributes in markdown, an attacker can embed arbitrary HTML and script-executing elements. When untrusted...

CVE-2026-59711

A flaw was found in showdown. This cross-site scripting XSS vulnerability occurs in the metadata title handling when the completeHTMLDocument option is enabled. An attacker can exploit this by injecting unescaped less-than and greater-than characters into markdown frontmatter metadata. This allow...

com.github.linyuzai:concept-plugin-spring-boot-starter (>=2.0.0, <=3.0.0), org.webjars.npm:github-com-showdownjs-ng-showdown (1.1.0) +3 more potentially affected by CVE-2026-59710 via org.webjars.npm:showdown (>=1.9.1, <=2.1.0)

org.webjars.npm:showdown MAVEN version =1.9.1, =2.0.0, =1.0.2, =1.0.3 - org.webjars.npm:showdown-prism 0.2.0 Source cves: CVE-2026-59710 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-17874451...

Cross-site Scripting (XSS)

Overview showdown is a JavaScript Markdown to HTML converter. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the parseHeaders function. An attacker can execute arbitrary scripts in the context of users viewing rendered markdown by injecting specially crafted table...

Cross-site Scripting (XSS)

Overview org.webjars.npm:showdown is a JavaScript Markdown to HTML converter. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the parseHeaders function. An attacker can execute arbitrary scripts in the context of users viewing rendered markdown by injecting special...

20mk-utils (>=1.0.0, <=1.0.3), 2d-spirograph (>=1.0.2, <=1.0.4) +2124 more potentially affected by CVE-2026-59710 via showdown (>=0.0.1, <=2.1.0)

showdown NPM version =0.0.1, =1.0.0, =1.0.2, =2.0.4, =1.0.6, =0.1.4, =0.1.4, =0.1.4, =13.351.0, =13.351.0, =7.10.0, =7.10.0, =0.0.3, =0.5.1 - @adalink/spark-chat 1.0.0 and more Source cves: CVE-2026-59710 Source advisory: SNYK:JS-SHOWDOWN-17874450...

showdown allows stored cross-site scripting through table header ID injection

showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails to properly escape table header ID attributes. Attackers can inject arbitrary HTML and script-executing SVG elements through double-quote characters in markdo...

@rocketmakers/prettier-config (>=1.0.1, <=2.1.0), @rocketmakers/stylelint-config (>=1.0.1, <=2.1.0) potentially affected by CVE-2026-59710 via showdown (2.0.1)

showdown NPM version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on showdown and may be impacted: - @rocketmakers/prettier-config =1.0.1, =1.0.1, =2.1.0 Source cves: CVE-2026-59710 Source advisory: OSV:GHSA-22G5-R2X5-97CX...

Cross-site Scripting (XSS)

Overview showdown is a JavaScript Markdown to HTML converter. Affected versions of this package are vulnerable to Cross-site Scripting XSS in metadata title handling, which inserts markdown frontmatter metadata into the HTML element without escaping the less-than and greater-than characters. An...

com.github.linyuzai:concept-plugin-spring-boot-starter (>=2.0.0, <=3.0.0), org.webjars.npm:github-com-showdownjs-ng-showdown (1.1.0) +3 more potentially affected by CVE-2026-59711 via org.webjars.npm:showdown (>=1.9.1, <=2.1.0)

org.webjars.npm:showdown MAVEN version =1.9.1, =2.0.0, =1.0.2, =1.0.3 - org.webjars.npm:showdown-prism 0.2.0 Source cves: CVE-2026-59711 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-17874449...

20mk-utils (>=1.0.0, <=1.0.3), 2d-spirograph (>=1.0.2, <=1.0.4) +2124 more potentially affected by CVE-2026-59711 via showdown (>=0.0.1, <=2.1.0)

showdown NPM version =0.0.1, =1.0.0, =1.0.2, =2.0.4, =1.0.6, =0.1.4, =0.1.4, =0.1.4, =13.351.0, =13.351.0, =7.10.0, =7.10.0, =0.0.3, =0.5.1 - @adalink/spark-chat 1.0.0 and more Source cves: CVE-2026-59711 Source advisory: SNYK:JS-SHOWDOWN-17874448...

Cross-site Scripting (XSS)

Overview org.webjars.npm:showdown is a JavaScript Markdown to HTML converter. Affected versions of this package are vulnerable to Cross-site Scripting XSS in metadata title handling, which inserts markdown frontmatter metadata into the HTML element without escaping the less-than and greater-than...

@rocketmakers/prettier-config (>=1.0.1, <=2.1.0), @rocketmakers/stylelint-config (>=1.0.1, <=2.1.0) potentially affected by CVE-2026-59711 via showdown (2.0.1)

showdown NPM version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on showdown and may be impacted: - @rocketmakers/prettier-config =1.0.1, =1.0.1, =2.1.0 Source cves: CVE-2026-59711 Source advisory: OSV:GHSA-CR32-G25G-VXJJ...

CVE-2026-59710

showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails to properly escape table header ID attributes. Attackers can inject arbitrary HTML and script-executing SVG elements through double-quote characters in markdo...

CVE-2026-59710 showdown - Stored XSS via Unescaped Table Header ID Attribute Injection

showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails to properly escape table header ID attributes. Attackers can inject arbitrary HTML and script-executing SVG elements through double-quote characters in markdo...

CVE-2026-59710

Showdown (the Showdown library) contains a stored XSS flaw in parseHeaders (src/subParsers/makehtml/tables.js) where table header ID attributes are not properly escaped. Attackers can inject arbitrary HTML and script-executing SVG elements through double-quote characters in Markdown table headers...

CVE-2026-59710 showdown - Stored XSS via Unescaped Table Header ID Attribute Injection

showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails to properly escape table header ID attributes. Attackers can inject arbitrary HTML and script-executing SVG elements through double-quote characters in markdo...

CVE-2026-59710 showdown - Stored XSS via Unescaped Table Header ID Attribute Injection

showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails to properly escape table header ID attributes. Attackers can inject arbitrary HTML and script-executing SVG elements through double-quote characters in markdo...

CVE-2026-59711 showdown - Cross-Site Scripting via Unescaped Metadata Title in completeHTMLDocument

showdown contains a cross-site scripting vulnerability in metadata title handling that allows attackers to inject arbitrary HTML and JavaScript. When completeHTMLDocument option is enabled, unescaped less-than and greater-than characters in markdown frontmatter metadata are inserted directly into...

CVE-2026-59711

CVE-2026-59711 affects the showdown library. A cross-site scripting vulnerability exists in metadata title handling when the completeHTMLDocument option is enabled; unescaped characters in markdown frontmatter metadata are placed into HTML title tags, allowing script execution in the rendered pa...