Vulnerability · Published Oct 8, 2026 · Assigned by VulnCheck

CVE-2026-105829League CommonMark 1.3.0 before 2.10.2 Stored XSS via DisallowedRawHtml Bypass

Medium 6.1

In plain English

A medium-severity security flaw in commonmark from thephpleague. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.2%top 83.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

League CommonMark from 1.3.0 before 2.10.2 contains a cross-site scripting vulnerability that allows users posting Markdown to bypass the DisallowedRawHtml extension by ending raw HTML with a bare disallowed tag name. Attackers can place a lone <script or <iframe line followed by a block supplying attributes like src or onload, executing stored scripts in viewers' browsers under default GFM settings.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	php-league-commonmark	no fix listed	DEBIAN-CVE-2026-105829
Debian:13	php-league-commonmark	no fix listed	DEBIAN-CVE-2026-105829
Debian:14	php-league-commonmark	2.10.3-1	DEBIAN-CVE-2026-105829
Packagist	league/commonmark	2.10.2	GHSA-97jj-33gv-5xf9
Ubuntu:26.04:LTS	php-league-commonmark	no fix listed	UBUNTU-CVE-2026-105829
Ubuntu:26.10	php-league-commonmark	no fix listed	UBUNTU-CVE-2026-105829

Affected products (as reported)

Vendor	Product	Versions
thephpleague	commonmark	see references

Weakness: CWE-80 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

GitHub Security Advisory (GHSA-97jj-33gv-5xf9) vendor-advisory
VulnCheck Advisory: League CommonMark 1.3.0 before 2.10.2 Stored XSS via DisallowedRawHtml Bypass third-party-advisory