TI-2026-23667 Aliases CVE-2026-30838 GHSA-4v6x-c7xx-hw9f

league/commonmark: DisallowedRawHtml extension bypass via whitespace in HTML tag names

LOW 23CWE-79Published 2026-03-07 · Updated 2026-03-09

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Cross-site scripting
Confidentiality · integrity · availability: None · Low · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

league/commonmark is a PHP Markdown parser. Prior to version 2.8.1, the DisallowedRawHtml extension can be bypassed by inserting a newline, tab, or other ASCII whitespace character between a disallowed HTML tag name and the closing >. For example, <script\n> would pass through unfiltered and be rendered as a valid HTML tag by browsers. This is a cross-site scripting (XSS) vector for any application that relies on this extension to sanitize untrusted user input. All applications using the DisallowedRawHtml extension to process untrusted markdown are affected. Applications that use a dedicated HTML sanitizer (such as HTML Purifier) on the rendered output are not affected. This issue has been patched in version 2.8.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00245 15th percentileScored 2026-11-07

Fix Fixed commonmark (thephpleague): 2.8.1league/commonmark (Packagist): 2.8.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
thephpleague	commonmark	before 2.8.1	2.8.1	Patch available	CNA
—	league/commonmark (Packagist)	2.0.0 to before 2.8.1	2.8.1	Patch available	GHSA-4v6x-c7xx-hw9f

commonmark Vendorthephpleague Affected before 2.8.1 Fixed in 2.8.1 Patch available CNA
league/commonmark (Packagist) Vendor— Affected 2.0.0 to before 2.8.1 Fixed in 2.8.1 Patch available GHSA-4v6x-c7xx-hw9f

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:thephpleague:commonmark::::::::	before 2.8.1	Vulnerable	thephpleague

cpe:2.3:a:thephpleague:commonmark:*:*:*:*:*:*:*:* Versions before 2.8.1 Vulnerable ·thephpleague

Remediation

Fix · CNA commonmark (thephpleague) Fixed in 2.8.1
Fix · GHSA-4v6x-c7xx-hw9f league/commonmark (Packagist) Fixed in 2.8.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-30838
2026-10-03 Alias added: GHSA-4v6x-c7xx-hw9f

References

Advisory 2

Other 2

TI-2026-59138 league/commonmark before 2.9.1 Denial of Service via parsing CVSS 4.0HIGH 8.7
TI-2026-59137 commonmark before 2.9.1 Denial of Service via SmartPunct and Attributes CVSS 4.0HIGH 8.7
TI-2026-59136 commonmark 1.5.0 before 2.10.0 Denial of Service via Attributes CVSS 4.0HIGH 8.7
TI-2026-59139 commonmark before 2.9.1 XSS via AttributesExtension form feed bypass CVSS 4.0MEDIUM 6.9
TI-2026-25753 league/commonmark has an embed extension allowed_domains bypass CVSS 4.0MEDIUM 6.3
TI-2018-14605 Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library versions… CVSS 3.0MEDIUM 6.1

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences