CyberRota Analysis
AI-GeneratedThe vulnerability affects GitHub's showdown library, specifically in the parseHeaders function, which improperly escapes table header ID attributes. This flaw allows attackers to inject arbitrary HTML and SVG elements, leading to stored cross-site scripting (XSS) when untrusted markdown is rendered. Organizations using GitHub that rely on markdown rendering should prioritize patching this vulnerability to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails to properly escape table header ID attributes. Attackers can inject arbitrary HTML and script-executing SVG elements through double-quote characters in markdown table headers, achieving stored XSS when untrusted markdown is rendered with the default github flavor configuration.