TI-2026-69534 Aliases CVE-2026-105829 GHSA-6vmm-7pc2-g2g6

Cross-site scripting in League CommonMark bypasses DisallowedRawHtml

MEDIUM 57CWE-80Published 2026-10-08 · Updated 2026-10-10

Key facts

Attack vector: Network
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-80.

Summary

League CommonMark from 1.3.0 before 2.10.2 is affected. A bypass of the DisallowedRawHtml extension (CWE-80) lets Markdown authors end raw HTML with a bare disallowed tag name, then supply attributes such as src or onload in a following block. A user who posts Markdown can store script that runs in viewers' browsers under default GFM settings.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

League CommonMark from 1.3.0 before 2.10.2 contains a cross-site scripting vulnerability that allows users posting Markdown to bypass the DisallowedRawHtml extension by ending raw HTML with a bare disallowed tag name. Attackers can place a lone <script or <iframe line followed by a block supplying attributes like src or onload, executing stored scripts in viewers' browsers under default GFM settings.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.0025 16th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
thephpleague	commonmark	—	—	Not affected	CNA

commonmark Vendorthephpleague Affected — Fixed in — Not affected CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:thephpleague:commonmark::::::::	—	—	thephpleague

cpe:2.3:a:thephpleague:commonmark:*:*:*:*:*:*:*:* Versions — — ·thephpleague

Remediation

Upgrade League CommonMark to 2.10.2 or later. Versions before 2.10.2 are affected.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

2026-10-08 Threatist record created from CVE-2026-105829
2026-10-08 Alias added: GHSA-6vmm-7pc2-g2g6
2026-10-10 CISA SSVC decision points changed
2026-10-10 Priority changed: LOW → MEDIUM

References

Advisory 1

GitHub Security Advisory (GHSA-97jj-33gv-5xf9)

TI-2026-69535 league/commonmark Quadratic DoS via TableStartParser CVSS 4.0HIGH 8.7
TI-2026-50093 league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes CVSS 3.1MEDIUM 6.1
TI-2026-65445 Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is… CVSS 3.1LOW 3.5
TI-2021-12376 Time-of-check Time-of-use (TOCTOU) Race Condition in league/flysystem CVSS 3.1CRITICAL 9.8
TI-2026-59143 commonmark 1.5.0 before 2.8.4 Denial of Service via Footnote CVSS 4.0HIGH 8.7
TI-2026-59142 commonmark 2.0.0 through 2.8.3 Denial of Service via Slug Collision CVSS 4.0HIGH 8.7

See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences