league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal

Medium · CVSS 6.1

## Summary The `DisallowedRawHtml` extension does not escape a disallowed tag when the tag name is the last thing in the raw HTML. A Markdown line containing just `<script` is emitted unchanged, and the next block can supply its attributes. With the shipped GFM defaults this allows stored XSS by anyone who can post Markdown. ## Details `DisallowedRawHtmlRenderer` escapes tags with this regex: ``` /<(\/?(?:title|textarea|style|xmp|iframe|noembed|noframes|script|plaintext)[\s\/>])/i ``` The trailing character class requires one character after the tag name.

Remediation

Upgrade league/commonmark to 2.10.2 or later.

Affected PHP branches

See the source advisory.

Check your site

Source: GitHub Global Security Advisories (Composer ecosystem) · retrieved 2026-10-22T10:19:14-04:00 · https://github.com/advisories/GHSA-97jj-33gv-5xf9

← All threats