GHSA-97jj-33gv-5xf9: league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal

September 30, 2026

Summary

The DisallowedRawHtml extension does not escape a disallowed tag when the tag name is the last thing in the raw HTML. A Markdown line containing just <script is emitted unchanged, and the next block can supply its attributes. With the shipped GFM defaults this allows stored XSS by anyone who can post Markdown.

References

github.com/advisories/GHSA-97jj-33gv-5xf9
github.com/thephpleague/commonmark/commit/411afcc2a7402756d96c89af8882c724d12d47ca
github.com/thephpleague/commonmark/releases/tag/2.10.2
github.com/thephpleague/commonmark/security/advisories/GHSA-97jj-33gv-5xf9

Code Behaviors & Features

Detect and mitigate GHSA-97jj-33gv-5xf9 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →