league/commonmark: DisallowedRawHtml extension bypass via whitespace in HTML tag names
Summary
league/commonmark: DisallowedRawHtml extension bypass via whitespace in HTML tag names
Original description
The description as published by the source.
league/commonmark is a PHP Markdown parser. Prior to version 2.8.1, the DisallowedRawHtml extension can be bypassed by inserting a newline, tab, or other ASCII whitespace character between a disallowed HTML tag name and the closing >. For example, would pass through unfiltered and be rendered as a valid HTML tag by browsers. This is a cross-site scripting (XSS) vector for any application that relies on this extension to sanitize untrusted user input. All applications using the DisallowedRawHtml extension to process untrusted markdown are affected. Applications that use a dedicated HTML sanitizer (such as HTML Purifier) on the rendered output are not affected. This issue has been patched in version 2.8.1.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2026-30838 php-league-commonmark
- Ubuntu UBUNTU-CVE-2026-30838 php-league-commonmark Fixed in: 1.3.1-1ubuntu2+esm1
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov