{"id":"CVE-2026-30838","aliases":["CLSA-2026-1776731783","CLSA-2026-1776904648","DEBIAN-CVE-2026-30838","EUVD-2026-10168","GHSA-4v6x-c7xx-hw9f","UBUNTU-CVE-2026-30838","USN-8194-1"],"status":"published","title":"league/commonmark: DisallowedRawHtml extension bypass via whitespace in HTML tag names","description":"league/commonmark is a PHP Markdown parser. Prior to version 2.8.1, the DisallowedRawHtml extension can be bypassed by inserting a newline, tab, or other ASCII whitespace character between a disallowed HTML tag name and the closing \u003e. For example, \u003cscript\\n\u003e would pass through unfiltered and be rendered as a valid HTML tag by browsers. This is a cross-site scripting (XSS) vector for any application that relies on this extension to sanitize untrusted user input. All applications using the DisallowedRawHtml extension to process untrusted markdown are affected. Applications that use a dedicated HTML sanitizer (such as HTML Purifier) on the rendered output are not affected. This issue has been patched in version 2.8.1.","severity":{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00245,"percentile":0.15926,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2026-03-06T23:27:03Z","modified":"2026-10-28T02:30:41Z","fixes":[{"ecosystem":"Packagist","package":"league/commonmark","fixed_in":["2.8.1"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Packagist","package":"league/commonmark","fixed_in":["1.6.7-p3+tuxcare"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"php-league-commonmark","fixed_in":["2.3.9-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"php-league-commonmark","fixed_in":["2.7.0-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"php-league-commonmark","fixed_in":["2.8.1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"php-league-commonmark","fixed_in":["1.3.1-1ubuntu2+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"php-league-commonmark","fixed_in":["1.6.7-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"php-league-commonmark","fixed_in":["2.4.2-2ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"league/commonmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"last_affected":"2.8.0"},{"fixed":"2.8.1"}]}]},{"source":"osv","ecosystem":"TuxCare:Packagist","package":"league/commonmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.7"},{"fixed":"1.6.7-p3+tuxcare"}]}],"versions":["1.6.7","1.6.7-p1+tuxcare","1.6.7-p2+tuxcare"]},{"source":"osv","ecosystem":"TuxCare:Packagist","package":"league/commonmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.1"},{"fixed":"2.7.1-p1+tuxcare"}]}],"versions":["2.7.1"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"php-league-commonmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.9-1+deb12u1"}]}],"versions":["2.3.9-1"]},{"source":"osv","ecosystem":"Debian:13","package":"php-league-commonmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0-1+deb13u1"}]}],"versions":["2.7.0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"php-league-commonmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.1-1"}]}],"versions":["2.7.0-1","2.7.1-1","2.7.1-2","2.8.0-1"]},{"source":"osv","ecosystem":"Packagist","package":"league/commonmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.8.1"}]}],"versions":["2.0.0","2.0.1","2.0.2","2.0.3","2.0.4","2.1.0","2.1.1","2.1.2","2.1.3","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5","2.3.0","2.3.1","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.9","2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.5.0","2.5.1","2.5.2","2.5.3","2.6.0","2.6.1","2.6.2","2.7.0","2.7.1","2.8.0"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"php-league-commonmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-1ubuntu2+esm1"}]}],"versions":["1.1.2-1","1.2.0-1","1.3.0-1","1.3.1-1","1.3.1-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"php-league-commonmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.7-1ubuntu0.1~esm1"}]}],"versions":["1.5.7-2build1","1.6.6-1build1","1.6.7-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"php-league-commonmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2-2ubuntu0.1~esm1"}]}],"versions":["2.3.9-1","2.4.1-1","2.4.2-1","2.4.2-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"php-league-commonmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.1-2","2.6.2-1","2.7.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"php-league-commonmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.0-1","2.8.2-2","2.8.3-1","2.10.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"php-league-commonmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.0-1","2.7.1-2","2.8.0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"php-league-commonmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-1ubuntu2+esm1"}]}],"versions":["1.1.2-1","1.2.0-1","1.3.0-1","1.3.1-1","1.3.1-1ubuntu2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"php-league-commonmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.7-1ubuntu0.1~esm1"}]}],"versions":["1.5.7-2build1","1.6.6-1build1","1.6.7-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"php-league-commonmark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2-2ubuntu0.1~esm1"}]}],"versions":["2.3.9-1","2.4.1-1","2.4.2-1","2.4.2-2"],"bundled":3}],"products":[{"vendor":"thephpleague","product":"commonmark"}],"references":[{"url":"https://github.com/thephpleague/commonmark/security/advisories/GHSA-4v6x-c7xx-hw9f","tags":["x_refsource_CONFIRM","Mitigation","Vendor Advisory","advisory","web","report"]},{"url":"https://commonmark.thephpleague.com/extensions/disallowed-raw-html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30838","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4v6x-c7xx-hw9f"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30838.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-30838","tags":["advisory"]},{"url":"https://github.com/thephpleague/commonmark","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-30838","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-30838","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8194-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-46734","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-33347","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-30838","title":"league/commonmark: DisallowedRawHtml extension bypass via whitespace in HTML tag names","description":"league/commonmark is a PHP Markdown parser. Prior to version 2.8.1, the DisallowedRawHtml extension can be bypassed by inserting a newline, tab, or other ASCII whitespace character between a disallowed HTML tag name and the closing \u003e. For example, \u003cscript\\n\u003e would pass through unfiltered and be rendered as a valid HTML tag by browsers. This is a cross-site scripting (XSS) vector for any application that relies on this extension to sanitize untrusted user input. All applications using the DisallowedRawHtml extension to process untrusted markdown are affected. Applications that use a dedicated HTML sanitizer (such as HTML Purifier) on the rendered output are not affected. This issue has been patched in version 2.8.1.","status":"published","published":"2026-03-07T16:00:32.351Z","modified":"2026-03-09T18:26:15.482Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T13:44:07.200604Z"}],"euvd":[{"id":"EUVD-2026-10168","description":"league/commonmark is a PHP Markdown parser. Prior to version 2.8.1, the DisallowedRawHtml extension can be bypassed by inserting a newline, tab, or other ASCII whitespace character between a disallowed HTML tag name and the closing \u003e. For example, \u003cscript\\n\u003e would pass through unfiltered and be rendered as a valid HTML tag by browsers. This is a cross-site scripting (XSS) vector for any application that relies on this extension to sanitize untrusted user input. All applications using the DisallowedRawHtml extension to process untrusted markdown are affected. Applications that use a dedicated HTML sanitizer (such as HTML Purifier) on the rendered output are not affected. This issue has been patched in version 2.8.1.","status":"published","published":"2026-03-07T16:00:32Z","modified":"2026-03-09T18:26:15Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:48:06.581696Z"}],"ghsa":[{"id":"GHSA-4v6x-c7xx-hw9f","title":"CommonMark has DisallowedRawHtml extension bypass via whitespace in HTML tag names","description":"### Impact\n\nThe `DisallowedRawHtml` extension can be bypassed by inserting a newline, tab, or other ASCII whitespace character between a disallowed HTML tag name and the closing `\u003e`. For example, `\u003cscript\\n\u003e` would pass through unfiltered and be rendered as a valid HTML tag by browsers. This is a cross-site scripting (XSS) vector for any application that relies on this extension to sanitize untrusted user input.\n\nAll applications using the `DisallowedRawHtml` extension to process untrusted markdown are affected. Applications that use a dedicated HTML sanitizer (such as HTML Purifier) on the rendered output are not affected.\n\n### Patches\n\nFixed in 2.8.1. The regex character class `[ \\/\u003e]` was changed to `[\\s\\/\u003e]` to match all whitespace characters that browsers accept as valid tag name terminators.\n\n### Workarounds\n\n- Set the `html_input` configuration option to `'escape'` or `'strip'` to disable all raw HTML, though this is a broader restriction than the `DisallowedRawHtml` extension provides.\n- Pass the rendered HTML through a dedicated HTML sanitizer before serving it to users ([always recommended](https://commonmark.thephpleague.com/2.x/security/#additional-filtering))","status":"published","published":"2026-03-06T23:27:03Z","modified":"2026-03-20T21:26:32Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:39:39.567266Z"}],"nvd":[{"id":"CVE-2026-30838","description":"league/commonmark is a PHP Markdown parser. Prior to version 2.8.1, the DisallowedRawHtml extension can be bypassed by inserting a newline, tab, or other ASCII whitespace character between a disallowed HTML tag name and the closing \u003e. For example, \u003cscript\\n\u003e would pass through unfiltered and be rendered as a valid HTML tag by browsers. This is a cross-site scripting (XSS) vector for any application that relies on this extension to sanitize untrusted user input. All applications using the DisallowedRawHtml extension to process untrusted markdown are affected. Applications that use a dedicated HTML sanitizer (such as HTML Purifier) on the rendered output are not affected. This issue has been patched in version 2.8.1.","status":"published","published":"2026-03-07T16:15:56.25Z","modified":"2026-06-17T10:33:00.337Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:08.279852Z"}],"osv":[{"id":"CVE-2026-30838","title":"league/commonmark: DisallowedRawHtml extension bypass via whitespace in HTML tag names","description":"league/commonmark is a PHP Markdown parser. Prior to version 2.8.1, the DisallowedRawHtml extension can be bypassed by inserting a newline, tab, or other ASCII whitespace character between a disallowed HTML tag name and the closing \u003e. For example, \u003cscript\\n\u003e would pass through unfiltered and be rendered as a valid HTML tag by browsers. This is a cross-site scripting (XSS) vector for any application that relies on this extension to sanitize untrusted user input. All applications using the DisallowedRawHtml extension to process untrusted markdown are affected. Applications that use a dedicated HTML sanitizer (such as HTML Purifier) on the rendered output are not affected. This issue has been patched in version 2.8.1.","status":"published","published":"2026-03-07T16:00:32.351Z","modified":"2026-10-28T02:30:41.746757739Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:45:00.530889Z"},{"id":"DEBIAN-CVE-2026-30838","description":"league/commonmark is a PHP Markdown parser. Prior to version 2.8.1, the DisallowedRawHtml extension can be bypassed by inserting a newline, tab, or other ASCII whitespace character between a disallowed HTML tag name and the closing \u003e. For example, \u003cscript\\n\u003e would pass through unfiltered and be rendered as a valid HTML tag by browsers. This is a cross-site scripting (XSS) vector for any application that relies on this extension to sanitize untrusted user input. All applications using the DisallowedRawHtml extension to process untrusted markdown are affected. Applications that use a dedicated HTML sanitizer (such as HTML Purifier) on the rendered output are not affected. This issue has been patched in version 2.8.1.","status":"published","published":"2026-03-07T16:15:56.25Z","modified":"2026-10-01T03:03:02.562009964Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:53.877573Z"},{"id":"GHSA-4v6x-c7xx-hw9f","title":"CommonMark has DisallowedRawHtml extension bypass via whitespace in HTML tag names","description":"### Impact\n\nThe `DisallowedRawHtml` extension can be bypassed by inserting a newline, tab, or other ASCII whitespace character between a disallowed HTML tag name and the closing `\u003e`. For example, `\u003cscript\\n\u003e` would pass through unfiltered and be rendered as a valid HTML tag by browsers. This is a cross-site scripting (XSS) vector for any application that relies on this extension to sanitize untrusted user input.\n\nAll applications using the `DisallowedRawHtml` extension to process untrusted markdown are affected. Applications that use a dedicated HTML sanitizer (such as HTML Purifier) on the rendered output are not affected.\n\n### Patches\n\nFixed in 2.8.1. The regex character class `[ \\/\u003e]` was changed to `[\\s\\/\u003e]` to match all whitespace characters that browsers accept as valid tag name terminators.\n\n### Workarounds\n\n- Set the `html_input` configuration option to `'escape'` or `'strip'` to disable all raw HTML, though this is a broader restriction than the `DisallowedRawHtml` extension provides.\n- Pass the rendered HTML through a dedicated HTML sanitizer before serving it to users ([always recommended](https://commonmark.thephpleague.com/2.x/security/#additional-filtering))","status":"published","published":"2026-03-06T23:27:03Z","modified":"2026-03-20T21:35:35.482232Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:37.528068Z"},{"id":"UBUNTU-CVE-2026-30838","description":"league/commonmark is a PHP Markdown parser. Prior to version 2.8.1, the DisallowedRawHtml extension can be bypassed by inserting a newline, tab, or other ASCII whitespace character between a disallowed HTML tag name and the closing \u003e. For example, \u003cscript\\n\u003e would pass through unfiltered and be rendered as a valid HTML tag by browsers. This is a cross-site scripting (XSS) vector for any application that relies on this extension to sanitize untrusted user input. All applications using the DisallowedRawHtml extension to process untrusted markdown are affected. Applications that use a dedicated HTML sanitizer (such as HTML Purifier) on the rendered output are not affected. This issue has been patched in version 2.8.1.","status":"published","published":"2026-03-07T16:15:00Z","modified":"2026-10-17T12:58:08.145837967Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N","level":"medium"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:11.640778Z"},{"id":"CLSA-2026-1776731783","title":"TuxCare security update for league/commonmark (1 CVE)","description":"TuxCare rebuilt league/commonmark to address 1 CVE. Fixed in 1.6.7-p3+tuxcare.","status":"published","published":"2026-08-04T14:52:27Z","modified":"2026-10-15T09:47:59.54829268Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1776904648","title":"TuxCare security update for league/commonmark (2 CVEs)","description":"TuxCare rebuilt league/commonmark to address 2 CVEs. Fixed in 2.7.1-p1+tuxcare.","status":"published","published":"2026-08-04T14:52:28Z","modified":"2026-10-15T09:47:59.573506718Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"USN-8194-1","title":"php-league-commonmark vulnerabilities","description":"It was discovered that league/commonmark did not properly restrict\nunsafe attributes when the Attributes extension was enabled. An attacker\ncould possibly use this issue to cause cross-site scripting by injecting\nmalicious code into rendered HTML. This issue only affected Ubuntu 22.04\nLTS and Ubuntu 24.04 LTS. (CVE-2025-46734)\n\nIt was discovered that league/commonmark did not properly block certain\ndisallowed HTML tags in some cases. An attacker could possibly use this\nissue to cause cross-site scripting by inserting malicious HTML that\nbypassed filtering. (CVE-2026-30838)\n\nIt was discovered that league/commonmark did not properly enforce domain\nallowlist checks in the Embed extension. An attacker could possibly use\nthis issue to bypass domain restrictions and cause untrusted content to\nbe treated as allowed. This issue only affected Ubuntu 24.04 LTS.\n(CVE-2026-33347)","status":"published","published":"2026-04-21T17:25:51Z","modified":"2026-04-27T19:14:32.92647985Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}