CVE-2026-105829 Overview
CVE-2026-105829 is a stored cross-site scripting (XSS) vulnerability in the League CommonMark PHP library, affecting versions from 1.3.0 before 2.10.2. The flaw allows attackers submitting Markdown content to bypass the DisallowedRawHtml extension by terminating raw HTML with a bare disallowed tag name. A lone <script or <iframe line followed by a block supplying attributes such as src or onload executes attacker-controlled scripts in viewers' browsers under default GitHub Flavored Markdown (GFM) settings. The weakness is categorized as CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page.
Critical Impact
Attackers can execute stored JavaScript in any viewer's browser session, enabling session hijacking, credential theft, and account takeover on applications rendering untrusted Markdown.
Affected Products
- League CommonMark versions 1.3.0 through 2.10.1
- Applications using the DisallowedRawHtml extension under default GFM configuration
- PHP web applications that render user-supplied Markdown with the vulnerable library
Discovery Timeline
- 2026-10-08 - CVE-2026-105829 published to NVD
- 2026-10-10 - Last updated in NVD database
Technical Details for CVE-2026-105829
Vulnerability Analysis
The League CommonMark library parses Markdown into HTML and ships with the DisallowedRawHtml extension to strip dangerous tags such as <script>, <iframe>, <style>, and <title>. This extension is enabled by default in the GFM configuration used by many PHP applications.
The filter identifies disallowed tags by matching complete opening tag patterns. When a raw HTML block ends with only a tag name and no closing bracket, the parser does not classify it as a disallowed element. Attackers exploit this parsing gap by splitting a malicious tag across Markdown structures. A viewer loading the rendered page triggers the resulting script execution without further interaction beyond page load.
Root Cause
The root cause is incomplete neutralization of script-related tag fragments. The DisallowedRawHtml extension matches canonical tag syntax but fails to account for truncated raw HTML terminators that the HTML parser later completes when adjacent attribute blocks are concatenated during rendering.
Attack Vector
Exploitation requires an attacker to post Markdown content to an application that renders it with League CommonMark and the default GFM extension set. The attacker crafts a payload where a bare <script or <iframe token appears at the end of one raw HTML line, followed by a separate block supplying src, onload, or similar attributes. The DisallowedRawHtml filter does not strip the fragment, and the browser interprets the concatenated output as an executing script element. See the GitHub Security Advisory GHSA-97jj-33gv-5xf9 and the VulnCheck Advisory on League CommonMark XSS for technical details.
Detection Methods for CVE-2026-105829
Indicators of Compromise
- Stored Markdown entries containing bare <script or <iframe tokens at line boundaries without a closing > character.
- Rendered HTML output containing executable <script> or <iframe> elements originating from user-generated Markdown fields.
- Unexpected outbound requests from client browsers to attacker-controlled domains after loading pages that render user Markdown.
Detection Strategies
- Scan user-generated Markdown content in databases for the regex patterns <script\s*$ and <iframe\s*$ at end-of-line positions.
- Inspect rendered HTML output in integration tests to verify that <script> and <iframe> elements never appear from Markdown input.
- Audit application dependency manifests (composer.lock) for league/commonmark versions between 1.3.0 and 2.10.2.
Monitoring Recommendations
- Enable Content Security Policy (CSP) violation reporting to detect script execution from unexpected inline sources.
- Log and alert on Web Application Firewall (WAF) matches against Markdown submission endpoints containing fragmented HTML tag patterns.
- Monitor browser-side telemetry for anomalous script loads on pages that render community-authored Markdown.
How to Mitigate CVE-2026-105829
Immediate Actions Required
- Upgrade league/commonmark to version 2.10.2 or later through Composer across all affected PHP applications.
- Audit all user-submitted Markdown stored in databases for exploit patterns and sanitize or remove malicious entries.
- Rotate session tokens and credentials for user accounts that may have viewed compromised pages.
Patch Information
The maintainers released a fix in League CommonMark version 2.10.2. The patch strengthens the DisallowedRawHtml extension to recognize and neutralize bare tag fragments. Review the GitHub Security Advisory GHSA-97jj-33gv-5xf9 for the authoritative patch reference and version matrix.
Workarounds
- Deploy a strict Content Security Policy that blocks inline scripts and restricts script-src and frame-src to trusted origins.
- Post-process rendered HTML with a dedicated sanitizer such as HTML Purifier to strip <script> and <iframe> elements before serving.
- Disable the GFM raw HTML allowance by configuring CommonMark with html_input: 'strip' until the upgrade is deployed.
# Configuration example
composer require league/commonmark:^2.10.2
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
