CVE-2026-59710 identifies a stored XSS vulnerability in showdown's parseHeaders function. The vulnerability occurs due to improper escaping of table header ID attributes, enabling injection of malicious HTML and SVG script elements through specially crafted markdown table headers. This can lead to stored XSS when untrusted markdown content is rendered with the default GitHub flavor. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). No patch or remediation details are currently provided, and there are no known exploits in the wild.

Successful exploitation allows an attacker to inject and execute arbitrary scripts in the context of users viewing the rendered markdown, potentially leading to session hijacking, defacement, or other malicious actions typical of stored XSS vulnerabilities. The vulnerability affects applications using showdown to render untrusted markdown with the default GitHub flavor configuration.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid rendering untrusted markdown with showdown using the default GitHub flavor configuration or apply input sanitization to markdown table headers to prevent injection of double-quote characters and script elements.