CVE-2026-105829

Executive Summary

CVE-2026-105829 is a stored cross-site scripting (XSS) vulnerability in the League CommonMark PHP library affecting versions from 1.3.0 before 2.10.2. Under default GitHub-Flavored Markdown (GFM) settings, an attacker who can post Markdown content can bypass the DisallowedRawHtml extension by ending raw HTML with a bare disallowed tag name, then supplying attributes on a following block — resulting in script execution in the browsers of users who view the rendered content. The vulnerability requires user interaction (a victim viewing the malicious page) and, given the ubiquity of CommonMark as a Markdown rendering backend, has a broad potential blast radius across any application embedding the affected library.

Technical Analysis

League CommonMark is a PHP implementation of the CommonMark specification, widely embedded in web applications (forums, comment systems, CMS platforms, documentation portals) to render user-supplied Markdown to HTML. The library provides a DisallowedRawHtml extension intended to sanitize raw HTML embedded in Markdown input by stripping or escaping dangerous tags such as <script> and <iframe>.

The core defect described in the NVD entry is a parser/sanitizer mismatch. The DisallowedRawHtml extension is designed to act on raw HTML blocks and inline raw HTML. However, the filter can be evaded when an attacker terminates raw HTML with a bare, disallowed tag name — that is, a lone <script or <iframe without a closing > on the same line — followed by a subsequent block that supplies the remaining attributes such as src or onload. Because the disallowed-tag detection logic does not correctly reconcile a tag split across block boundaries, the attribute-bearing continuation block is treated as ordinary content and is emitted into the final HTML without being sanitized. The rendered output therefore reconstitutes into a complete, executable script or iframe element in the victim's browser.

This is fundamentally a filter-bypass condition: the sanitizer's allow/deny decision is made on a lexical unit (the raw HTML block) that the attacker can fragment, so the dangerous tag material escapes inspection. Because the resulting HTML is persisted (the Markdown is stored and re-rendered on each view), the outcome is stored XSS, executing under default GFM settings — no non-default configuration is required for exploitation.

Attack surface: any application that accepts Markdown from untrusted users (PR:N per the CVSS vector) and renders it with an affected League CommonMark version using default GFM configuration and the DisallowedRawHtml extension enabled.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (base 6.1) reflects: network-reachable (AV:N), low complexity (AC:L), no privileges required to submit content (PR:N), but requiring the victim to view the rendered content (UI:R). The scope change (S:C) captures that the injected script executes in the origin of the hosting application, potentially affecting resources beyond the vulnerable component's own security authority — typically the session, cookies, and same-origin data of the hosting site. Confidentiality and integrity are rated Low (C:L/I:L) and availability is unaffected (A:N), consistent with a content-injection flaw whose primary risk is session/credential theft and unauthorized in-origin actions.

Note on specificity: The NVD description does not disclose the precise function, class, or parsing routine responsible for the bypass. No corrected code, commit hash, or vendor advisory detail is available in the provided data. The above describes the vulnerability class (raw-HTML sanitizer bypass resulting in stored XSS) and the mechanism named in the description (disallowed tag fragmented across block boundaries), without asserting implementation internals that are not evidenced.

Exploitation Scenarios

No public PoC is available, and no exploit code or Nuclei template is tracked for this CVE. The following attack chain is inferred strictly from the vulnerability class and the NVD description; it does not rely on any invented endpoint, parameter, or function name.

1. Reconnaissance / target identification. The attacker identifies a web application that accepts user-generated Markdown and renders it server-side with an affected League CommonMark version (1.3.0 up to but not including 2.10.2). Typical targets are comment sections, forum posts, issue trackers, and profile/bio fields. Fingerprinting can be aided by rendering behavior consistent with CommonMark and, where exposed, version metadata or package manifests.

2. Triggering the flaw. The attacker submits Markdown containing raw HTML that is split so the disallowed tag name terminates one block and the attributes are supplied on a following block. Per the description, a lone <script or <iframe line followed by a block supplying attributes such as src or onload causes the DisallowedRawHtml extension to fail to block the tag. The lexical fragmentation is the bypass primitive: the sanitizer inspects a unit that does not contain the closing > or the attribute payload.

3. Payload / execution (class level). On render, the pieces recombine into a complete HTML element in the page output. The browser parses it as executable content — a script element or an iframe whose src/onload attribute performs the attacker's action. Because output is stored, the payload fires for every user who subsequently views the affected content, in the security context (origin) of the hosting application.

4. Post-exploitation impact. The script runs same-origin with the hosting site. Standard stored-XSS consequences follow: theft of session tokens/cookies reachable to script, unauthorized state-changing requests on behalf of the victim, credential phishing rendered in a trusted origin, and redirection or drive-by content delivery via iframe src. Because submission requires no privileges (PR:N), a single low-privilege or anonymous post can seed a persistent payload viewed by many users.

Impact Assessment

Business impact centers on stored content persistence and origin compromise rather than data-at-rest loss. The scope change (S:C) means the injected script executes with the host application's origin authority, so the blast radius extends to that origin's sessions, cookies, and authenticated functionality — not merely the vulnerable component. Confidentiality (C:L) and integrity (I:L) are Low, reflecting typical XSS effects (limited data exposure and limited client-side modification), while availability (A:N) is unaffected.

Affected systems: any application embedding League CommonMark 1.3.0 through 2.10.1 with the DisallowedRawHtml extension and default GFM settings. Given CommonMark's role as a rendering backend for many PHP applications, the potential population is large; however, actual exposure depends on which deployed applications accept untrusted Markdown and render it to other users. User interaction (UI:R) is required, so the exploit is not self-propagating without a viewer. No affected package list, OSV entry, or vendor advisory is present in the provided data, so exact downstream product enumeration is not possible from this dataset alone.

Exploitability is currently assessed as limited by the absence of public PoC or exploit code (POC_STATUS: None) and no CISA KEV listing. EPSS has not been scored by FIRST.org and no value should be assumed. The principal business risk is persistent session/credential compromise and reputational harm from serving attacker-controlled script to users.

Detection Guidance

Sigma Rule

title: Potential League CommonMark DisallowedRawHtml Bypass (Stored XSS) - Suspicious Markdown Submission
id: 8f3c1a2e-5b7d-4c9a-9e21-commonmark105829
status: experimental
description: Detects submitted content containing a bare disallowed raw-HTML tag (script or iframe) split from its attribute block, indicative of CVE-2026-105829 exploitation attempts.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105829
author: valtersit.com
logsource:
  category: webserver
  product: generic
detection:
  selection_bare_tag:
    cs-uri-query|contains:
      - '<script'
      - '<iframe'
  selection_attribute_block:
    cs-uri-query|contains:
      - 'onload'
      - 'src='
      - 'onerror'
  condition: selection_bare_tag and selection_attribute_block
fields:
  - c-ip
  - cs-uri
  - cs-uri-query
  - cs-method
falsepositives:
  - Security scanners submitting markup
  - Legitimate documentation about HTML tags
level: medium

YARA Rule

rule CVE_2026_105829_CommonMark_DisallowedRawHtml_Bypass
{
    meta:
        author      = "valtersit.com"
        description = "Detects stored Markdown payloads fragmenting a disallowed raw HTML tag across blocks to bypass DisallowedRawHtml (CVE-2026-105829)"
        reference   = "https://nvd.nist.gov/vuln/detail/CVE-2026-105829"
        date        = "2026-01-01"
        severity    = "medium"

    strings:
        $t1 = "<script" ascii nocase
        $t2 = "<iframe" ascii nocase
        $a1 = "onload"   ascii nocase
        $a2 = "onerror"  ascii nocase
        $a3 = "src="     ascii nocase
        $tag_end = ">" ascii

    condition:
        filesize < 64KB and
        (($t1 or $t2) and ($a1 or $a2 or $a3))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105829 League CommonMark DisallowedRawHtml Bypass Stored XSS Attempt"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"<script"; nocase; http.request_body; content:"onload"; nocase; reference:cve,2026-105829; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-105829; classtype:web-application-attack; sid:900105829; rev:1;)

alert http any any -> any any (msg:"CVE-2026-105829 League CommonMark DisallowedRawHtml Bypass Stored XSS Attempt (iframe)"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"<iframe"; nocase; http.request_body; content:"src="; nocase; reference:cve,2026-105829; classtype:web-application-attack; sid:900105830; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [ network where http.request.method == "POST" and
      wildcard(http.request.body, "*<script*") ]
  [ network where http.request.method == "POST" and
      ( wildcard(http.request.body, "*onload*") or
        wildcard(http.request.body, "*onerror*") or
        wildcard(http.request.body, "*src=*") ) ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=stream:http
| eval body=coalesce(form_data, uri_query, request_body)
| where match(lower(body), "<(script|iframe)") AND match(lower(body), "(onload|onerror|src\s*=)")
| stats count min(_time) as first_seen max(_time) as last_seen values(method) as methods by src_ip, uri, host
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,cve-2026-105829,">
  <rule id="100829" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <match>script|iframe</match>
    <regex>onload|onerror|src=</regex>
    <description>CVE-2026-105829: Possible League CommonMark DisallowedRawHtml bypass (stored XSS) payload submitted</description>
    <mitre>
      <id>T1189</id>
    </mitre>
    <group>attack,web_application_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description states the issue exists "before 2.10.2"; this version boundary is described in the advisory data but no vendor commit, advisory URL, or release artifact is confirmed in the tracked sources provided. Treat 2.10.2 as the described remediation target and verify against the vendor's own release notes before deploying.

1. Immediate mitigations (until a verified patch is applied):

   • Sanitize rendered HTML output with a robust, well-maintained HTML sanitizer (e.g., a server-side allowlist sanitizer applied after Markdown rendering), rather than relying solely on the CommonMark DisallowedRawHtml extension.
   • Disable or restrict raw HTML in user-submitted Markdown where the application permits it (disable raw HTML input entirely, or render untrusted content in a sandboxed context).
   • Apply Content-Security-Policy headers that disallow inline and untrusted script (script-src restricted, no unsafe-inline), and serve user content on a separate origin/domain if feasible to neutralize same-origin XSS impact.
   • Set cookies HttpOnly and SameSite to limit session theft via injected script.
   • Rate-limit and monitor anonymous/low-privilege content submissions for tag-fragmentation patterns.

2. Patch / upgrade steps:

   • Upgrade League CommonMark to 2.10.2 or later (the version described as containing the fix), subject to verification against the vendor's advisory.
   • Audit dependency trees for embedded copies of the library and ensure all instances are updated, since it may be bundled as a transitive dependency.
   • After upgrading, re-render or re-sanitize previously stored content that may contain stored payloads seeded before remediation.

3. Long-term hardening:

   • Adopt defense-in-depth: never treat a single rendering-layer extension as the sole XSS control; pair rendering-time filtering with output-time sanitization and CSP.
   • Maintain SBOM coverage for Markdown/rendering libraries and subscribe to advisories for the League CommonMark project.
   • Add regression tests that feed fragmented raw HTML (bare disallowed tag names split from attribute blocks) into the rendering pipeline and assert sanitization.
   • Provide a clear patching cadence for third-party rendering libraries, given the broad attack surface of user-generated content.

References

• NVD — CVE-2026-105829: https://nvd.nist.gov/vuln/detail/CVE-2026-105829
• League CommonMark project (vendor/library source and release information): https://github.com/thephpleague/commonmark
• OWASP — Cross Site Scripting (XSS) prevention guidance: https://owasp.org/www-community/attacks/xss/
• CWE-80 — Improper Neutralization of Script-Related HTML Tags in a Web Page: https://cwe.mitre.org/data/definitions/80.html
• CISA Known Exploited Vulnerabilities catalog (status check — not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaign, exploit-in-the-wild activity, public PoC, or CISA KEV entry is associated with CVE-2026-105829 in the available data. POC_STATUS: None; no Nuclei template or exploit code is tracked. EPSS has not been scored by FIRST.org; no value is asserted.