CVE-2026-105829: League CommonMark 1.3.0 before 2.10.2 Stored XSS via DisallowedRawHtml Bypass
League CommonMark from 1.3.0 before 2.10.2 contains a cross-site scripting vulnerability that allows users posting Markdown to bypass the DisallowedRawHtml extension by ending raw HTML with a bare disallowed tag name. Attackers can place a lone <script or <iframe line followed by a block supplying attributes like src or onload, executing stored scripts in viewers' browsers under default GFM settings.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using composer/league/commonmark from version 1.3.0 before 2.10.2 are affected when users can submit Markdown that is later rendered for other users. The described attack works under default GFM settings.
What does an attacker need to exploit the vulnerability?
An attacker needs the ability to post crafted Markdown content. They can use a lone disallowed raw HTML tag name such as <script or <iframe followed by a block that supplies attributes such as src or onload, causing script execution when someone views the rendered content.
What is the immediate mitigation if upgrading is not possible?
The provided information does not specify a workaround. Until an upgrade is available, treat untrusted Markdown submissions as potentially able to execute stored scripts in viewers' browsers and restrict or disable untrusted Markdown posting where feasible.