Executive brief
CommonMark has DisallowedRawHtml extension bypass via whitespace in HTML tag names
Affected products
- Packagist league/commonmark
Junglewise Threat Intelligence
CVE-2026-30838: CommonMark has DisallowedRawHtml extension bypass via whitespace in HTML tag names
CVE-2026-30838 · Severity: medium · CVSS 4 · Published 2026-03-06
Technologies: league/commonmark (Packagist). Vendors: Packagist.