CVE-2026-30838

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-30838", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-05T21:06:44.606Z", "datePublished": "2026-03-07T16:00:32.351Z", "dateUpdated": "2026-03-09T18:26:15.482Z"}, "containers": {"cna": {"title": "league/commonmark: DisallowedRawHtml extension bypass via whitespace in HTML tag names", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/thephpleague/commonmark/security/advisories/GHSA-4v6x-c7xx-hw9f", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/thephpleague/commonmark/security/advisories/GHSA-4v6x-c7xx-hw9f"}], "affected": [{"vendor": "thephpleague", "product": "commonmark", "versions": [{"version": "< 2.8.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-07T16:00:32.351Z"}, "descriptions": [{"lang": "en", "value": "league/commonmark is a PHP Markdown parser. Prior to version 2.8.1, the DisallowedRawHtml extension can be bypassed by inserting a newline, tab, or other ASCII whitespace character between a disallowed HTML tag name and the closing >. For example, <script\\n> would pass through unfiltered and be rendered as a valid HTML tag by browsers. This is a cross-site scripting (XSS) vector for any application that relies on this extension to sanitize untrusted user input. All applications using the DisallowedRawHtml extension to process untrusted markdown are affected. Applications that use a dedicated HTML sanitizer (such as HTML Purifier) on the rendered output are not affected. This issue has been patched in version 2.8.1."}], "source": {"advisory": "GHSA-4v6x-c7xx-hw9f", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-09T17:38:55.476351Z", "id": "CVE-2026-30838", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T18:26:15.482Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-30838", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-09T17:38:55.476351Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T17:38:56.712Z"}}], "cna": {"title": "league/commonmark: DisallowedRawHtml extension bypass via whitespace in HTML tag names", "source": {"advisory": "GHSA-4v6x-c7xx-hw9f", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "thephpleague", "product": "commonmark", "versions": [{"status": "affected", "version": "< 2.8.1"}]}], "references": [{"url": "https://github.com/thephpleague/commonmark/security/advisories/GHSA-4v6x-c7xx-hw9f", "name": "https://github.com/thephpleague/commonmark/security/advisories/GHSA-4v6x-c7xx-hw9f", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "league/commonmark is a PHP Markdown parser. Prior to version 2.8.1, the DisallowedRawHtml extension can be bypassed by inserting a newline, tab, or other ASCII whitespace character between a disallowed HTML tag name and the closing >. For example, <script\\n> would pass through unfiltered and be rendered as a valid HTML tag by browsers. This is a cross-site scripting (XSS) vector for any application that relies on this extension to sanitize untrusted user input. All applications using the DisallowedRawHtml extension to process untrusted markdown are affected. Applications that use a dedicated HTML sanitizer (such as HTML Purifier) on the rendered output are not affected. This issue has been patched in version 2.8.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-07T16:00:32.351Z"}}}, "cveMetadata": {"cveId": "CVE-2026-30838", "state": "PUBLISHED", "dateUpdated": "2026-03-09T18:26:15.482Z", "dateReserved": "2026-03-05T21:06:44.606Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-07T16:00:32.351Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "commonmark", "vendor": "thephpleague", "versions": [{"status": "affected", "version": "< 2.8.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:thephpleague:commonmark:*:*:*:*:*:*:*:*", "matchCriteriaId": "EDAFDAD9-8D5C-4F37-8FE2-83179A2DAC86", "versionEndExcluding": "2.8.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "league/commonmark is a PHP Markdown parser. Prior to version 2.8.1, the DisallowedRawHtml extension can be bypassed by inserting a newline, tab, or other ASCII whitespace character between a disallowed HTML tag name and the closing >. For example, <script\\n> would pass through unfiltered and be rendered as a valid HTML tag by browsers. This is a cross-site scripting (XSS) vector for any application that relies on this extension to sanitize untrusted user input. All applications using the DisallowedRawHtml extension to process untrusted markdown are affected. Applications that use a dedicated HTML sanitizer (such as HTML Purifier) on the rendered output are not affected. This issue has been patched in version 2.8.1."}, {"lang": "es", "value": "league/commonmark es un analizador de Markdown de PHP. Antes de la versi\u00f3n 2.8.1, la extensi\u00f3n DisallowedRawHtml puede ser eludida insertando un salto de l\u00ednea, una tabulaci\u00f3n u otro car\u00e1cter de espacio en blanco ASCII entre el nombre de una etiqueta HTML no permitida y el signo de cierre &gt;. Por ejemplo, pasar\u00eda sin filtrar y ser\u00eda renderizado como una etiqueta HTML v\u00e1lida por los navegadores. Esto es un vector de cross-site scripting (XSS) para cualquier aplicaci\u00f3n que dependa de esta extensi\u00f3n para sanear la entrada de usuario no confiable. Todas las aplicaciones que utilizan la extensi\u00f3n DisallowedRawHtml para procesar markdown no confiable est\u00e1n afectadas. Las aplicaciones que utilizan un saneador de HTML dedicado (como HTML Purifier) en la salida renderizada no est\u00e1n afectadas. Este problema ha sido parcheado en la versi\u00f3n 2.8.1."}], "id": "CVE-2026-30838", "lastModified": "2026-06-17T10:33:00.337", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-30838", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-09T17:38:55.476351Z", "version": "2.0.3"}}]}, "published": "2026-03-07T16:15:56.250", "references": [{"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/thephpleague/commonmark/security/advisories/GHSA-4v6x-c7xx-hw9f"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.8.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "commonmark", "source": "cna", "vendor": "thephpleague"}, "product": "commonmark", "vendor": "thephpleague"}], "analysis": {"en": {"generated_at": "2026-04-17T12:09:28.017470+00:00", "value": {"mitigation_remediation": ["Upgrade thephpleague:commonmark to version\u202f2.8.1 or later", "Disable or remove the DisallowedRawHtml extension when rendering untrusted Markdown", "Apply an additional HTML sanitizer, such as HTML Purifier, to the final output before sending it to browsers"], "summary": {"action": "Patch Now", "impact": "Cross\u2011Site Scripting via Whitespace Bypass"}, "threat_synthesis": {"affected_systems": "All installations of thephpleague:commonmark before version\u202f2.8.1 that enable the DisallowedRawHtml extension are affected. This includes any PHP application that processes untrusted Markdown through the parser, such as web frameworks handling comments, posts, or API payloads. Applications that do not use this extension or that apply a separate HTML sanitizer after rendering are not vulnerable.", "description_and_impact": "The vulnerability is a flaw in the DisallowedRawHtml extension for the PHP Markdown parser league/commonmark, where inserting any ASCII whitespace between the tag name and the final \u2018>\u2019 bypasses the sanitizer. This allows disallowed tags like <script> to be rendered to the browser, enabling arbitrary JavaScript execution as an XSS vector. The weakness is an instance of CWE\u201179, representing unsafe handling of user\u2011supplied markup.", "risk_and_exploitability": "The CVSS base score of 5.1 indicates moderate severity, while an EPSS score of less than 1\u202f% points to a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw remotely by injecting crafted Markdown containing whitespace\u2011delimited disallowed tags via any user\u2011contributed content field. No special privileges or local access are required; the attack vector is typical web\u2011based user input."}}}}, "created": "2026-03-09T10:05:06.538354+00:00", "updated": "2026-04-17T12:15:18.167806+00:00", "vendors": ["thephpleague", "thephpleague$PRODUCT$commonmark"]}