{"id":"CVE-2026-105829","published":"2026-10-08T15:17:35.167","lastModified":"2026-10-10T04:18:09.177","description":"League CommonMark from 1.3.0 before 2.10.2 contains a cross-site scripting vulnerability that allows users posting Markdown to bypass the DisallowedRawHtml extension by ending raw HTML with a bare disallowed tag name. Attackers can place a lone <script or <iframe line followed by a block supplying attributes like src or onload, executing stored scripts in viewers' browsers under default GFM settings.","cvssScore":6.1,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cwes":["CWE-80"],"vendors":[],"products":[],"references":[{"url":"https://github.com/thephpleague/commonmark/security/advisories/GHSA-97jj-33gv-5xf9","tags":[]},{"url":"https://www.vulncheck.com/advisories/league-commonmark-1.3.0-before-2.10.2-stored-xss-via-disallowedrawhtml-bypass","tags":[]},{"url":"https://github.com/thephpleague/commonmark/security/advisories/GHSA-97jj-33gv-5xf9","tags":[]}],"exploitRefs":[{"url":"https://github.com/thephpleague/commonmark/security/advisories/GHSA-97jj-33gv-5xf9","tags":[]},{"url":"https://github.com/thephpleague/commonmark/security/advisories/GHSA-97jj-33gv-5xf9","tags":[]}],"hasPoc":true,"ai":null}