league/commonmark EUVD-2026-95016

league/commonmark is the PHP implementation of the CommonMark/GFM Markdown specification, widely used as the rendering engine behind PHP applications, forums, wikis and CMS front ends. The flaw sits in the DisallowedRawHtml extension's renderer, which scrubs dangerous raw HTML tags with the regular expression /<(\/?(?:title|textarea|style|xmp|iframe|noembed|noframes|script|plaintext)[\s\/>])/i; the trailing character class demands at least one character after the tag name, so a raw-HTML literal that terminates immediately after the tag name is never escaped. The underlying block parser is more permissive: RegexHelper::PARTIAL_HTMLBLOCKOPEN accepts an end-of-line after the tag name, meaning the single line <script legitimately opens an HTML block. Because a rendered HtmlBlock is emitted without a trailing newline the filter's regex finds no trailing character to match and lets the < through unescaped, yet in the browser the newline is still present and terminates the tag name, so any attributes introduced by the next Markdown block (<span src="...">, <span onload="...">) are absorbed into the script or iframe element and execute. This is the same filter class previously hardened in GHSA-4v6x-c7xx-hw9f (fixed in 2.8.1), where the character class was widened but the one-character requirement was retained, leaving this shape uncovered; the root cause class is CWE-80, improper neutralization of script-related HTML tags. The upstream fix allows end-of-string after the tag name (([\s\/>]|$)), escaping the bypass shapes while leaving benign markup such as <div>, <scripts> and <span class="a"> untouched.