{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"2.1.0"}],"component":"showdown","cve_ids":["CVE-2026-59710"],"ecosystem":"npm","epss":0.00338,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-22g5-r2x5-97cx","id":"tcs_01M5KERMA7SXK312YKPTH5CYVB","modified_at":"2026-09-10T03:51:09.845674087Z","published_at":"2026-07-07T00:30:59Z","references":["https://osv.dev/vulnerability/GHSA-22g5-r2x5-97cx","https://nvd.nist.gov/vuln/detail/CVE-2026-59710","https://github.com/showdownjs/showdown/issues/1046","https://github.com/showdownjs/showdown/commit/e5cab1e9a5dcea2bb3cbf888863fa7e65ab37edf","https://github.com/showdownjs/showdown","https://www.vulncheck.com/advisories/showdown-stored-xss-via-unescaped-table-header-id-attribute-injection"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-22g5-r2x5-97cx","url":"https://osv.dev/vulnerability/GHSA-22g5-r2x5-97cx"}],"summary":"showdown allows stored cross-site scripting through table header ID injection"}