CVE-2026-105829: thephpleague commonmark, XSS

Описание

Оригинално описание

League CommonMark from 1.3.0 before 2.10.2 contains a cross-site scripting vulnerability that allows users posting Markdown to bypass the DisallowedRawHtml extension by ending raw HTML with a bare disallowed tag name. Attackers can place a lone <script or <iframe line followed by a block supplying attributes like src or onload, executing stored scripts in viewers' browsers under default GFM settings.

Засегнати продукти

• thephpleague commonmark

Вид слабост

• CWE-80 Неправилна неутрализация на HTML тагове за скриптове в уеб страница

История

Други уязвимости в thephpleague commonmark

• 8.7CVE-2026-105830
• 8.7CVE-2024-58382
• 8.7CVE-2026-86435
• 8.7CVE-2026-86434
• 8.7CVE-2026-86433

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-105829
• https://nvd.nist.gov/vuln/detail/CVE-2026-105829
• https://github.com/thephpleague/commonmark/security/advisories/GHSA-97jj-33gv-5xf9
• https://www.vulncheck.com/advisories/league-commonmark-1.3.0-before-2.10.2-stored-xss-via-disallowedrawhtml-bypass