# league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal
Advisory record · `GHSA-97jj-33gv-5xf9`
- **Identifiers:** `GHSA-97jj-33gv-5xf9` · `CVE-2026-105829` · `PKSA-m2dq-1fhr-29b1`
- **State:** Confirmed
- **Severity:** CVSS 5.3 Medium
- **Critical:** No
- **Weakness (CWE):** [CWE-78](https://cwe.mitre.org/data/definitions/78.html) · [CWE-79](https://cwe.mitre.org/data/definitions/79.html) · [CWE-80](https://cwe.mitre.org/data/definitions/80.html)
- **Tags:** [Command injection](https://agentprime.io/advisories/tag/command-injection.md) · [Cross-site scripting (XSS)](https://agentprime.io/advisories/tag/xss.md)
- **Published:** 30 Sept 2026
- **Updated:** 9 Oct 2026
- **Reviewed by a person:** No
Published by the GitHub Advisory Database at 30 Sept 2026, 15:36 UTC. agentprime has not analysed this yet, so whether it affects any app is not known.
## Affected packages
- `league/commonmark` (Packagist): affected `>=1.3.0, <2.10.2`; fixed in `2.10.2`
## Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
> The league/commonmark package, versions 1.3.0 up to 2.10.2 (fixed in 2.10.2), has a flaw in the DisallowedRawHtml extension: a disallowed tag name at the very end of a raw HTML line, such as a bare script or iframe opening tag, is not escaped. An attacker who can post Markdown can use this to inject script into rendered pages when html_input is set to allow, which is the default with the GFM extension, and no account beyond posting content is described. Upgrade to league/commonmark 2.10.2 or later; setting html_input to escape or strip also mitigates the issue.
Written 31 Oct 2026.
## Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
## Severity and exploitation
- 5.3 Medium, CVSS 4.0: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N`, from CNA (VulnCheck)
- **CISA KEV:** Not listed.
- **EPSS:** 0.0025, the 16th percentile, on 11 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
## Timeline
- 21 Sept 2026, 12:30 UTC: [Published by the maintainers as a GitHub repository advisory](https://github.com/thephpleague/commonmark/security/advisories/GHSA-97jj-33gv-5xf9)
- 31 Oct 2026, 13:54 UTC: First seen by agentprime
- 31 Oct 2026, 13:54 UTC: [Confirmed by OSV](https://osv.dev/vulnerability/GHSA-97jj-33gv-5xf9)
## Sources
- [GitHub Advisory Database: GHSA-97jj-33gv-5xf9](https://github.com/advisories/GHSA-97jj-33gv-5xf9)
- [OSV: GHSA-97jj-33gv-5xf9](https://osv.dev/vulnerability/GHSA-97jj-33gv-5xf9)
-
-
-
-
Facts on this page come from the GitHub Advisory Database (CC-BY 4.0), OSV and the other sources listed, as published. We don’t reproduce full advisory descriptions, which can contain exploit code.
## Check whether this affects you
A Match means an installed version is in the affected range above. Most don’t affect the app; agentprime hasn’t analysed this one yet.
- With the agentprime MCP server (), ask your agent to check the project: `check_lockfile` sends a lockfile, `check_packages` a list of installed packages, and both return the Matches and the upgrades that clear them. `get_advisory` returns this record. Setup:
- In a browser: reads your lockfile in the browser, never uploading it.
- Whether it touches your code, with file and line: the Claude Code plugin,
- As JSON: , or `POST https://api.agentprime.io/v1/match` with your packages ()
---
The web page: . Everything for agents: .