Is there a patch available for CVE-2026-59710?

Yes, a patch is available for CVE-2026-59710. Update the affected software to the latest version immediately.

showdown CVE-2026-59710

Q: What is the CVSS score of CVE-2026-59710?

CVE-2026-59710 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-41954 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-06 VulnCheck

GHSA-22g5-r2x5-97cx

XSS Red Hat Showdown

5.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.1 MEDIUM

Network-delivered stored XSS, no privileges needed from attacker, passive victim view required, scope change to victim browser with low C and I impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Red Hat

6.1 MEDIUM

qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 06, 2026 - 22:45 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

951 npm packages depend on showdown (475 direct, 486 indirect)

Ecosystem-wide dependent count for version 2.1.0.

DescriptionCVE.org

showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails to properly escape table header ID attributes. Attackers can inject arbitrary HTML and script-executing SVG elements through double-quote characters in markdown table headers, achieving stored XSS when untrusted markdown is rendered with the default github flavor configuration.

AnalysisAI

Stored cross-site scripting in the showdown JavaScript Markdown-to-HTML library allows an unauthenticated attacker to inject arbitrary HTML and script-executing SVG elements by placing double-quote characters inside Markdown table headers. The unescaped content is written directly into HTML id attributes by the parseHeaders function in src/subParsers/makehtml/tables.js, and the payload is stored and later executed in every victim's browser that views the rendered output. No active exploitation has been confirmed (not in CISA KEV) and no EPSS data was supplied, but the default github flavor configuration means most showdown deployments are affected without any non-default setup required.

Technical ContextAI

showdown (CPE: cpe:2.3:a:showdown:showdown:*:*:*:*:*:*:*:*) is a JavaScript Markdown-to-HTML converter used in both browser and Node.js environments. When the github flavor option is active - which is the default - the parseHeaders function in src/subParsers/makehtml/tables.js generates an id attribute for each table header cell to support anchor-linked headings. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): the raw header string is interpolated into the id="..." attribute without HTML-encoding double-quote characters or other special markup characters. This allows an attacker to terminate the attribute value, close the tag, and inject additional HTML nodes - including inline SVG elements carrying event handlers such as onload - directly into the document tree. Because the injected markup is generated server-side or at render time and then persisted or served to other users, the attack class is stored (persistent) XSS rather than reflected.

RemediationAI

Upstream fix available via commit e5cab1e9a5dcea2bb3cbf888863fa7e65ab37edf (https://github.com/showdownjs/showdown/commit/e5cab1e9a5dcea2bb3cbf888863fa7e65ab37edf); a released patched npm version is not independently confirmed from the available data - monitor the showdown npm package and GitHub releases for a tagged version that includes this commit, then upgrade as soon as one is available. As an immediate compensating control, pipe showdown's HTML output through a dedicated HTML sanitizer such as DOMPurify before inserting it into the DOM; this eliminates injected event handlers and script-bearing SVG nodes at the rendering layer and is effective regardless of showdown version, though it adds a runtime dependency and must be applied consistently across every rendering path. Alternatively, if table anchor IDs are not required, investigate whether the github flavor table-header-ID feature can be disabled in the showdown options object to prevent the vulnerable code path from executing; this avoids the XSS without a full upgrade but trades anchor-linking functionality. Applications that only render Markdown written by the same authenticated user who views it face minimal real-world risk and can deprioritize patching relative to multi-user platforms.