Commonmark
CVE-2026-30838
MEDIUM
GHSA-4v6x-c7xx-hw9f
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 6.1 (MEDIUM). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: Required. |
| Exploit ScenarioDerived | An attacker could exploit this vulnerability to compromise the affected system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
The DisallowedRawHtml extension in PHP Commonmark (league/commonmark) versions prior to 2.8.1 can be bypassed by injecting whitespace characters between HTML tag names and closing brackets, allowing malicious scripts to pass sanitization filters and execute in user browsers. Applications relying solely on this extension to sanitize untrusted markdown input are vulnerable to cross-site scripting attacks, though those using additional HTML sanitizers are unaffected. No patch is currently available for affected versions.
Earlier versions of this analysis (1)
league/commonmark is a PHP Markdown parser. Prior to version 2.8.1, the DisallowedRawHtml extension can be bypassed by inserting a newline, tab, or other ASCII whitespace character between a disallowed HTML tag name and the closing >. [CVSS 6.1 MEDIUM]
RemediationAI
Fixed in version 2.8.1.. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in composer
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Classified as CWE-79 (Cross-site Scripting (XSS)). Affects Commonmark. league/commonmark is a PHP Markdown parser. Prior to version 2.8.1, the DisallowedRawHtml extension can be bypassed by inserting a newline, tab, or other ASCII whitespace character between a disallowed HTML tag name and the closing >. For example, <script\n> would pass through unfiltered and be rendered as a valid HTML tag by browsers. This is a cross-site scripting (XSS) vector for any application that relies on this extension to sanitize untrusted user input. All applications using the Disallo
Know when Commonmark gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
league/commonmark is a PHP Markdown parser. Prior to version 2.8.1, the DisallowedRawHtml extension can be bypassed by inserting a newline, tab, or other ASCII whitespace character between a disallowed HTML tag name and the closing >. For example, <script\n> would pass through unfiltered and be rendered as a valid HTML tag by browsers. This is a cross-site scripting (XSS) vector for any application that relies on this extension to sanitize untrusted user input. All applications using the DisallowedRawHtml extension to process untrusted markdown are affected. Applications that use a dedicated HTML sanitizer (such as HTML Purifier) on the rendered output are not affected. This issue has been patched in version 2.8.1.
Executive ViewAI
CVE-2026-30838 presents moderate security risk, a cross-site scripting vulnerability rated CVSS 6.1. Attackers could inject scripts to steal sessions or perform actions as authenticated users. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: implement CSP headers, enable HttpOnly cookies, deploy WAF XSS rules.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Affected Products (CPE)GitHub Advisory
More in Commonmark
View allCross-site scripting (XSS) vulnerability in the PHP League CommonMark library before 0.18.3 allows remote attackers to i
Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library versions 0.15.6 through 0.18.x before 0.18
Quadratic CPU exhaustion in league/commonmark 2.0.0-2.8.3 allows unauthenticated remote attackers to deny service by sub
Quadratic-time algorithmic complexity in league/commonmark's Attributes extension exposes PHP applications to remote den
Quadratic parsing complexity in league/commonmark (thephpleague/commonmark, versions ≥1.5.0 and <2.9.1) allows unauthent
Three independent super-linear parsing paths in league/commonmark before 2.9.1 allow unauthenticated remote attackers to
Quadratic-blowup denial of service in league/commonmark's Footnote extension allows remote unauthenticated attackers to
Quadratic CPU exhaustion in league/commonmark's optional AttributesExtension (versions 1.5.0 through 2.9.2) allows unaut
Quadratic-time denial of service in league/commonmark 2.0.0 through 2.10.1 lets unauthenticated remote attackers exhaust
Quadratic memory and output amplification in league/commonmark's XmlRenderer affects all 2.x releases from 2.0.0 through
Cross-site scripting in league/commonmark 2.7.0-2.9.0 allows unauthenticated attackers to inject arbitrary JavaScript in
Stored cross-site scripting in league/commonmark from 1.3.0 through 2.10.1 lets any user who can post Markdown bypass th
Exploit-DB