https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-18T15:25:59.215429+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-59710 CVE-2026-59710 — showdown - Stored XSS via Unescaped Table Header ID Attribute Injection 2026-10-18T15:25:59.234064+00:00

Affected: showdown

showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails to properly escape table header ID attributes. Attackers can inject arbitrary HTML and script-executing SVG elements through double-quote characters in markdown table headers, achieving stored XSS when untrusted markdown is rendered with the default github flavor configuration.