GHSA-97jj-33gv-5xf9

league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal

Published

2026-09-30

Modified

2026-09-30

Sources

github-advisory

Summary

## Summary The `DisallowedRawHtml` extension does not escape a disallowed tag when the tag name is the last thing in the raw HTML. A Markdown line containing just ` ])/i ``` The trailing character class requires one character after the tag name. The block parser does not: `RegexHelper::PARTIAL_HTMLBLOCKOPEN` accepts end of line after a tag name, so ` ``` Output: ```html ``` A browser parses that as ` ` with a junk ` ` works the same way and does not need a later ` ` in the page. Control: ` ` is correctly escaped to `<script src="/evil.js"></script>`. ## Affected versions 1.3.0 (when the extension was added) through the current release. The ` ]|$)/i', \implode('|', \array_map('preg_quote', $tags))); return \preg_replace($regex, '<$1$2', $rendered); ``` This escapes every bypass shape above and leaves ` `, ` ` and ` ` untouched. The existing unit test only covers tag names followed by another character, so a case for a bare tag name should be added.

Affected packages

Remediation: Upgrade to 2.10.2 or later.

References

• https://github.com/advisories/GHSA-97jj-33gv-5xf9