{"uuid": "dd97905e-1b09-4743-b383-ab3bd749ee1e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-97JJ-33GV-5XF9", "type": "seen", "source": "https://gist.github.com/alon710/30f7653e99030ebd772bd5697fbcbef9", "content": "# GHSA-97JJ-33GV-5XF9: GHSA-97jj-33gv-5xf9: Stored Cross-Site Scripting Bypass in league/commonmark DisallowedRawHtml Extension\n\n> **CVSS Score:** 6.1\n> **Published:** 2026-09-30\n> **Full Report:** https://cvereports.com/reports/GHSA-97JJ-33GV-5XF9\n\n## Summary\nA security vulnerability in league/commonmark versions 1.3.0 through 2.10.1 allows remote attackers to bypass Stored Cross-Site Scripting (XSS) protections in the DisallowedRawHtml extension. Due to an validation logic flaw in the regular expression parser, specifically handling bare, unclosed HTML blocks ending at the string boundary, raw HTML tags can be passed to the rendered output. When combined with browser-side parsing heuristics, an attacker can execute arbitrary JavaScript in the context of the user session.\n\n## TL;DR\nA regular expression flaw in league/commonmark allows attackers to bypass the DisallowedRawHtml filter using unclosed tags at block boundaries, resulting in Stored Cross-Site Scripting (XSS).\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-79\n- **Attack Vector**: Network (AV:N)\n- **CVSS**: 6.1 (Medium)\n- **EPSS Score**: N/A (No CVE assigned)\n- **Exploit Status**: poc\n- **KEV Status**: false\n\n## Affected Systems\n\n- Applications using league/commonmark to render Markdown to HTML with raw HTML input enabled.\n- **league/commonmark**: >= 1.3.0, <= 2.10.1 (Fixed in: `2.10.2`)\n\n## Mitigation\n\n- Upgrade league/commonmark to version 2.10.2 or higher.\n- Set 'html_input' configuration option to 'escape' or 'strip' to block all raw HTML parsing.\n\n**Remediation Steps:**\n1. Analyze composer.lock to identify the currently installed version of league/commonmark.\n2. Execute 'composer update league/commonmark' to retrieve the latest safe version (2.10.2+).\n3. If immediate patching is not possible, modify the MarkdownConverter initialization array to enforce 'html_input' => 'escape'.\n4. Verify the fix by rendering test payloads with bare HTML tags and ensuring they are escaped into safe HTML entities.\n\n## References\n\n- [GitHub Advisory Database: GHSA-97jj-33gv-5xf9](https://github.com/advisories/GHSA-97jj-33gv-5xf9)\n- [league/commonmark Security Advisory: XSS Bypass in DisallowedRawHtml](https://github.com/thephpleague/commonmark/security/advisories/GHSA-97jj-33gv-5xf9)\n- [Fix Commit 411afcc](https://github.com/thephpleague/commonmark/commit/411afcc2a7402756d96c89af8882c724d12d47ca)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-97JJ-33GV-5XF9) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-30T19:30:29.000000Z"}