PT-2026-23795 · Unknown+2 · League/Commonmark+2

Colinodell · Published 2026-03-06 · Updated 2026-04-21 · CVE-2026-30838

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions league/commonmark versions prior to 2.8.1

Description The DisallowedRawHtml extension in league/commonmark can be bypassed by inserting ASCII whitespace characters between a disallowed HTML tag name and the closing '>'. For example, `<script

` would pass through unfiltered and be rendered as a valid HTML tag by browsers. This creates a cross-site scripting (XSS) vector for applications relying on this extension to sanitize untrusted user input. Applications using a dedicated HTML sanitizer, such as HTML Purifier, on the rendered output are not affected. The issue stems from a regex character class that did not match all whitespace characters accepted by browsers as valid tag name terminators.

Recommendations Versions prior to 2.8.1 should be updated to version 2.8.1 or later. As a workaround, set the html input configuration option to 'escape' or 'strip' to disable all raw HTML. Pass the rendered HTML through a dedicated HTML sanitizer before serving it to users.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-30838

GHSA-4V6X-C7XX-HW9F

USN-8194-1

Affected Products

Linuxmint

Ubuntu

League/Commonmark

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30838.json · Exploit
• https://github.com/thephpleague/commonmark/security/advisories/GHSA-4v6x-c7xx-hw9f · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-46734 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30838 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-30838 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33347 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-30838 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-30838 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8194-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-30838 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4v6x-c7xx-hw9f · Vendor Advisory
• https://osv.dev/vulnerability/USN-8194-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-30838 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-30838 · Security Note
• https://github.com/thephpleague/commonmark · Note