All vulnerabilities
CVE-2026-105829GHSA-97jj-33gv-5xf9

League CommonMark 1.3.0 before 2.10.2 Stored XSS via DisallowedRawHtml Bypass

thephpleague commonmarkPackagistLibraries & packages
Open in ThreatlineRecord JSON
CVSS
5.3Medium
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 10 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.20%Chance of exploitation activity in the next 30 days, higher than 9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2.10.2Fixed versionOSV
Published8 Oct 2026Updated 10 Oct 2026CVE List

What fixes it

  • 2.10.2league/commonmark, PackagistOSVcomposer require "league/commonmark:^2.10.2"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

League CommonMark from 1.3.0 before 2.10.2 contains a cross-site scripting vulnerability that allows users posting Markdown to bypass the DisallowedRawHtml extension by ending raw HTML with a bare disallowed tag name. Attackers can place a lone <script or <iframe line followed by a block supplying attributes like src or onload, executing stored scripts in viewers' browsers under default GFM settings.

Text from CVE List

Affected versions 51

  • league/commonmark, Packagistfrom 1.3.0, fixed in 2.10.2OSV
  • league/commonmark, Packagist1.3.0OSV
  • league/commonmark, Packagist1.3.1OSV
  • league/commonmark, Packagist1.3.2OSV
  • league/commonmark, Packagist1.3.3OSV
  • league/commonmark, Packagist1.3.4OSV
  • league/commonmark, Packagist1.4.0OSV
  • league/commonmark, Packagist1.4.1OSV
  • league/commonmark, Packagist1.4.2OSV
  • league/commonmark, Packagist1.4.3OSV
  • league/commonmark, Packagist1.5.0OSV
  • league/commonmark, Packagist1.5.1OSV
  • league/commonmark, Packagist1.5.2OSV
  • league/commonmark, Packagist1.5.3OSV
  • league/commonmark, Packagist1.5.4OSV
  • league/commonmark, Packagist1.5.5OSV
  • league/commonmark, Packagist1.5.6OSV
  • league/commonmark, Packagist1.5.7OSV
  • league/commonmark, Packagist1.5.8OSV
  • league/commonmark, Packagist1.6.0OSV
  • league/commonmark, Packagist1.6.1OSV
  • league/commonmark, Packagist1.6.2OSV
  • league/commonmark, Packagist1.6.3OSV
  • league/commonmark, Packagist1.6.4OSV
  • league/commonmark, Packagist1.6.5OSV
  • league/commonmark, Packagist1.6.6OSV
  • league/commonmark, Packagist1.6.7OSV
  • league/commonmark, Packagist2.0.0OSV
  • league/commonmark, Packagist2.0.0-beta1OSV
  • league/commonmark, Packagist2.0.0-beta2OSV
  • league/commonmark, Packagist2.0.0-beta3OSV
  • league/commonmark, Packagist2.0.0-rc1OSV
  • league/commonmark, Packagist2.0.0-rc2OSV
  • league/commonmark, Packagist2.0.1OSV
  • league/commonmark, Packagist2.0.2OSV
  • league/commonmark, Packagist2.0.3OSV
  • league/commonmark, Packagist2.0.4OSV
  • league/commonmark, Packagist2.1.0OSV
  • league/commonmark, Packagist2.1.1OSV
  • league/commonmark, Packagist2.1.2OSV
  • league/commonmark, Packagist2.1.3OSV
  • league/commonmark, Packagist2.10.0OSV
  • league/commonmark, Packagist2.10.1OSV
  • league/commonmark, Packagist2.2.0OSV
  • league/commonmark, Packagist2.2.1OSV
  • league/commonmark, Packagist2.2.2OSV
  • league/commonmark, Packagist2.2.3OSV
  • league/commonmark, Packagist2.2.4OSV
  • league/commonmark, Packagist2.2.5OSV
  • league/commonmark, Packagist2.3.0OSV
  • league/commonmark, Packagist2.3.1OSV

References 2