Showdown contains a stored cross-site scripting (XSS) vulnerability in its table header ID parsing function. The vulnerability arises because the parseHeaders function in src/subParsers/makehtml/tables.js does not properly escape double-quote characters in markdown table headers. This allows attackers to inject arbitrary HTML and script-executing SVG elements, leading to stored XSS when untrusted markdown is rendered using the default GitHub flavor configuration. The vulnerability affects all versions up to and including 2.1.0. The CVSS score is 6.1, indicating a medium severity issue.