Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
league/commonmark is a PHP Markdown parser. Prior to version 2.8.1, the DisallowedRawHtml extension can be bypassed by inserting a newline, tab, or other ASCII whitespace character between a disallowed HTML tag name and the closing >. For example, <script\n> would pass through unfiltered and be rendered as a valid HTML tag by browsers. This is a cross-site scripting (XSS) vector for any application that relies on this extension to sanitize untrusted user input. All applications using the DisallowedRawHtml extension to process untrusted markdown are affected. Applications that use a dedicated HTML sanitizer (such as HTML Purifier) on the rendered output are not affected. This issue has been patched in version 2.8.1.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-07 | 2 | Disclosure2 |
| 2026-08-08 | 1 | Disclosure1 |
CVE-2026-30838 Cross-Site Scripting Vulnerability in league/commonmark Markdown Parser Before 2.8.1 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-30838
Post summary
The entry documents a Cross‑Site Scripting (XSS) vulnerability in league/commonmark Markdown Parser (before v2.8.1) but offers no evidence of PoCs, exploits, active attacks, patches, or debunking claims.
🔴 league/commonmark, Denial of Service, #CVE-2026-30838 (High) -DC-Aug2026-1468 https://dailycve.com/league-commonmark-denial-of-service-cve-2026-30838-high-dc-aug2026-1468/
Post summary
The text announces the disclosure of CVE-2026-30838, a Denial of Service vulnerability in league/commonmark rated as High severity, without providing PoC, exploit, or patch details.
CVE-2026-30838 league/commonmark is a PHP Markdown parser. Prior to version 2.8.1, the DisallowedRawHtml extension can be bypassed by inserting a newline, tab, or other ASCII whites… https://www.cve.org/CVERecord?id=CVE-2026-30838
Post summary
The snippet discloses a CVE affecting league/commonmark, describing a bypass technique for the DisallowedRawHtml extension via whitespace insertion.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | thephpleague | commonmark | - | - | - |