The stored cross-site scripting vulnerability in showdown occurs in the parseHeaders function responsible for processing table header ID attributes. Due to improper escaping of double-quote characters, an attacker can inject malicious HTML and SVG elements that execute scripts when rendered. This vulnerability is triggered when untrusted markdown content is processed with the default GitHub flavor configuration. The flaw is identified as CWE-79 (Improper Neutralization of Input During Web Page Generation). It affects all versions up to and including 2.1.0. There are no known exploits in the wild and no patch or official fix has been documented in the provided data.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the victim's browser when viewing rendered markdown content. This can lead to information disclosure and limited integrity impact. There is no direct availability impact. The vulnerability is remotely exploitable without privileges but requires user interaction (rendering of malicious markdown).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should avoid rendering untrusted markdown content with the default GitHub flavor configuration in showdown until a fix is available. Monitoring vendor channels for updates is recommended.