GHSA-97jj-33gv-5xf9: league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal

September 30, 2026

Summary

The DisallowedRawHtml extension does not escape a disallowed tag when the tag name is the last thing in the raw HTML. A Markdown line containing just <script is emitted unchanged, and the next block can supply its attributes. With the shipped GFM defaults this allows stored XSS by anyone who can post Markdown.

References

github.com/advisories/GHSA-97jj-33gv-5xf9
github.com/thephpleague/commonmark/commit/411afcc2a7402756d96c89af8882c724d12d47ca
github.com/thephpleague/commonmark/releases/tag/2.10.2
github.com/thephpleague/commonmark/security/advisories/GHSA-97jj-33gv-5xf9

Code Behaviors & Features

Detect and mitigate GHSA-97jj-33gv-5xf9 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →