CVE-2026-105829 League CommonMark 1.3.0 before 2.10.2 Stored XSS via DisallowedRawHtml Bypass
Attackers can execute stored scripts in viewers' browsers by bypassing raw HTML restrictions in the League CommonMark Markdown parser.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-105829?
CVE-2026-105829 is a medium-severity cross-site scripting vulnerability in thephpleague commonmark, published on 8 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
League CommonMark from 1.3.0 before 2.10.2 contains a cross-site scripting vulnerability that allows users posting Markdown to bypass the DisallowedRawHtml extension by ending raw HTML with a bare disallowed tag name. Attackers can place a lone <script or <iframe line followed by a block supplying attributes like src or onload, executing stored scripts in viewers' browsers under default GFM settings.
Weakness: CWE-80
Which versions are affected by CVE-2026-105829?
2 open source packages ship an affected version, including league/commonmark.
| Package | Affected | Fixed in |
|---|---|---|
league/commonmark Packagist | From 1.3.0 | 2.10.2 |
league/commonmark Packagist | From 1.3.0 | 2.10.2 |
How do I fix CVE-2026-105829?
Upgrade league/commonmark to 2.10.2 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-105829 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-105829 exists.
Sources
Also known as CLSA-2026-1791458521, DEBIAN-CVE-2026-105829, GHSA-6vmm-7pc2-g2g6, GHSA-97jj-33gv-5xf9, UBUNTU-CVE-2026-105829.