CVE-2026-105829 in CommonMark
Riassunto
di MITRE • 08/10/2026
League CommonMark from 1.3.0 before 2.10.2 contains a cross-site scripting vulnerability that allows users posting Markdown to bypass the DisallowedRawHtml extension by ending raw HTML with a bare disallowed tag name. Attackers can place a lone <script or <iframe line followed by a block supplying attributes like src or onload, executing stored scripts in viewers' browsers under default GFM settings.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.