CVE-2026-30838 league/commonmark: DisallowedRawHtml extension bypass via whitespace in HTML tag names
Attackers can bypass HTML sanitization in league/commonmark to inject malicious scripts via whitespace in tag names, leading to XSS.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-30838?
CVE-2026-30838 is a medium-severity cross-site scripting vulnerability in thephpleague commonmark, published on 7 Mar 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
league/commonmark is a PHP Markdown parser. Prior to version 2.8.1, the DisallowedRawHtml extension can be bypassed by inserting a newline, tab, or other ASCII whitespace character between a disallowed HTML tag name and the closing >. For example, <script\n> would pass through unfiltered and be rendered as a valid HTML tag by browsers. This is a cross-site scripting (XSS) vector for any application that relies on this extension to sanitize untrusted user input. All applications using the DisallowedRawHtml extension to process untrusted markdown are affected. Applications that use a dedicated HTML sanitizer (such as HTML Purifier) on the rendered output are not affected. This issue has been patched in version 2.8.1.
Weakness: CWE-79
Which versions are affected by CVE-2026-30838?
2 open source packages ship an affected version, including league/commonmark. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
league/commonmark Packagist | From 2.0.0 | 2.8.1 |
league/commonmark Packagist | From 2.0.0 | 2.8.1 |
Products include Thephpleague Commonmark.
How do I fix CVE-2026-30838?
Upgrade league/commonmark to 2.8.1 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-30838 being exploited?
There is no known exploitation of CVE-2026-30838 in the wild and no public exploit code.
Other vulnerabilities in thephpleague commonmark
- CVE-2026-86428 commonmark 1.5.0 before 2.10.0 Denial of Service via Attributes
- CVE-2026-86429 commonmark before 2.9.1 Denial of Service via SmartPunct and Attributes
- CVE-2026-86430 league/commonmark before 2.9.1 Denial of Service via parsing
- CVE-2026-86431 commonmark before 2.9.1 XSS via AttributesExtension form feed bypass
- CVE-2026-33347 league/commonmark has an embed extension allowed_domains bypass
Sources
Also known as CLSA-2026-1776731783, DEBIAN-CVE-2026-30838, GHSA-4v6x-c7xx-hw9f, UBUNTU-CVE-2026-30838.