Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2026-105829 →
DEBIAN-CVE-2026-105829
League CommonMark from 1.3.0 before 2.10.2 contains a cross-site scripting vulnerability that allows users posting Markdown to bypass the DisallowedRa...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
League CommonMark from 1.3.0 before 2.10.2 contains a cross-site scripting vulnerability that allows users posting Markdown to bypass the DisallowedRawHtml extension by ending raw HTML with a bare disallowed tag name. Attackers can place a lone <script or <iframe line followed by a block supplying attributes like src or onload, executing stored scripts in viewers' browsers under default GFM settings.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
php-league-commonmark
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:13
php-league-commonmark
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:14
php-league-commonmark
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.3-1"}]}]
Références
- advisory security-tracker.debian.org