CVE-2026-105829

Name of the Vulnerable Software and Affected Versions League CommonMark versions 1.3.0 through 2.10.1

Description An issue exists where users posting Markdown can bypass the DisallowedRawHtml extension by ending raw HTML with a bare disallowed tag name. This allows attackers to insert a lone <script or <iframe line followed by a block containing attributes such as src or onload, leading to the execution of stored scripts in the browsers of users viewing the content under default GFM (GitHub Flavored Markdown) settings.

Recommendations Update League CommonMark to version 2.10.2 or later.