CVE-2026-105829: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in thephpleague commonmark

Thephpleague commonmark versions 1.3.0 up to but not including 2.10.2 contain a stored cross-site scripting vulnerability. Attackers can exploit this by posting Markdown that includes raw HTML ending with a disallowed tag name without proper neutralization. This bypasses the DisallowedRawHtml extension, enabling execution of malicious scripts in the browsers of users viewing the content under default GFM settings. The vulnerability is identified as CVE-2026-105829 with a CVSS 4.0 base score of 5.3, indicating medium severity.

Successful exploitation allows attackers to execute arbitrary scripts in the context of the victim's browser when viewing Markdown content rendered by the vulnerable commonmark library. This can lead to typical XSS impacts such as session hijacking, defacement, or redirection. However, the attack requires user interaction (UI:P) and has low vector complexity (AC:L) with no privileges required (PR:N).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting the use of raw HTML in Markdown or applying custom sanitization to prevent injection of disallowed tags. Monitor thephpleague project for updates addressing this vulnerability.