The vulnerability is a stored cross‑site scripting flaw inside the parseHeaders function used for rendering markdown tables. It allows an attacker to embed arbitrary HTML and script‑enabled SVG elements by inserting double‑quote characters into rendered with Showdown’s default GitHub flavor configuration, the injected content is executed in the browser of any user who views the rendered output. The flaw originates from failure to escape the ID attribute, which is a classic input validation weakness classified as CWE‑79.

This issue impacts the Showdown.js markdown converter for both Node.js and browser environments. All releases that expose the parseHeaders function in src/subParsers/makehtml/tables.js are affected; the description does not tie the flaw to a specific version number, so any deployment that parses user‑generated markdown tables and renders them with risk. The affected product is Showdown.js, library version unspecified.

The CVSS base score of 5.3 indicates moderate severity. The EPSS probability is < 1 % and the vulnerability is not listed in CISA’s KEV catalog, suggesting a low likelihood of widespread exploitation. Nevertheless, stored XSS can be triggered by any visitor to trusted markdown with the default settings, so the potential impact remains significant for projects that use Showdown without additional sanitization.