CVE-2026-30838: Thephpleague Commonmark XSS Vulnerability

CVE-2026-30838 Overview

CVE-2026-30838 is a Cross-Site Scripting (XSS) vulnerability in the league/commonmark PHP Markdown parser. The DisallowedRawHtml extension, designed to filter dangerous HTML tags from user-supplied Markdown content, can be bypassed by inserting whitespace characters (newline, tab, or other ASCII whitespace) between a disallowed HTML tag name and the closing > character. This allows attackers to inject malicious scripts that pass through the sanitization filter and are rendered as valid HTML by browsers.

Critical Impact

Applications relying solely on the DisallowedRawHtml extension to sanitize untrusted user input are vulnerable to XSS attacks, potentially enabling session hijacking, credential theft, and malicious content injection.

Affected Products

• thephpleague commonmark versions prior to 2.8.1

Discovery Timeline

• 2026-03-07 - CVE CVE-2026-30838 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-30838

Vulnerability Analysis

The vulnerability exists in the DisallowedRawHtml extension's pattern matching logic for identifying and filtering dangerous HTML tags. The extension is intended to block specific HTML tags (such as <script>, <iframe>, <object>, etc.) from being rendered in the final HTML output. However, the regular expression or string matching implementation fails to account for whitespace characters that may appear between the tag name and the closing angle bracket.

When browsers parse HTML, they are tolerant of whitespace within tag definitions. A tag written as <script\n> or <script\t> is interpreted identically to <script>. The DisallowedRawHtml extension's filter does not normalize or strip these whitespace characters before performing its tag name comparison, allowing malformed but browser-valid HTML tags to pass through undetected.

Root Cause

The root cause is improper input validation (CWE-79) in the DisallowedRawHtml extension. The extension's filtering mechanism uses pattern matching that expects disallowed tags to appear in their canonical form without internal whitespace. By inserting ASCII whitespace characters (such as \n, \t, \r, or space) between the tag name and the closing >, attackers can craft payloads that evade the filter while remaining valid HTML that browsers will execute.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker can exploit this vulnerability by submitting specially crafted Markdown content containing obfuscated HTML tags to any application that processes untrusted Markdown using the vulnerable DisallowedRawHtml extension.

For example, an attacker could submit Markdown containing a script tag with a newline character inserted before the closing bracket. When this content is rendered to HTML without additional sanitization, the browser interprets it as a valid script tag and executes the malicious JavaScript. The attack payload might look like <script\n>alert('XSS')</script> in the raw Markdown input, which bypasses the filter but executes in the victim's browser context.

Detection Methods for CVE-2026-30838

Indicators of Compromise

• User-submitted content containing HTML tags with unusual whitespace patterns (newlines, tabs, carriage returns) immediately before the closing > character
• Rendered HTML output containing executable script tags that should have been filtered
• Client-side JavaScript errors or unexpected script execution originating from user-generated content areas
• Web application firewall logs showing HTML tag patterns with embedded whitespace characters

Detection Strategies

• Implement content security policy (CSP) headers with strict script-src directives to mitigate successful XSS exploitation
• Deploy web application firewall rules to detect HTML tags containing whitespace before the closing bracket
• Monitor application logs for unusual Markdown submissions containing encoded or obfuscated HTML patterns
• Perform regular security scanning of user-generated content for signs of XSS payload injection

Monitoring Recommendations

• Enable verbose logging for Markdown processing components to capture raw input and rendered output
• Set up alerts for CSP violation reports that may indicate attempted XSS exploitation
• Monitor for unusual patterns in user-submitted content that may indicate probing or exploitation attempts
• Review rendered HTML output periodically for unexpected script or iframe elements

How to Mitigate CVE-2026-30838

Immediate Actions Required

• Upgrade league/commonmark to version 2.8.1 or later immediately
• Audit all applications using the DisallowedRawHtml extension to determine exposure
• Implement a dedicated HTML sanitizer (such as HTML Purifier) on rendered output as a defense-in-depth measure
• Review user-generated content for signs of past exploitation

Patch Information

The vulnerability has been patched in league/commonmark version 2.8.1. The fix addresses the whitespace bypass by improving the pattern matching logic to properly handle whitespace characters within HTML tag definitions. For detailed information about the security fix, refer to the GitHub Security Advisory GHSA-4v6x-c7xx-hw9f.

Workarounds

• Apply a dedicated HTML sanitizer such as HTML Purifier to all rendered Markdown output before displaying to users
• Implement strict Content Security Policy headers to prevent inline script execution
• Pre-process user input to normalize and strip whitespace from within HTML-like tag structures
• Consider temporarily disabling user-generated Markdown rendering until the patch can be applied

# Upgrade league/commonmark using Composer
composer require league/commonmark:^2.8.1

# Verify the installed version
composer show league/commonmark | grep versions