league/commonmark is a PHP Markdown parser. Prior to version 2.8.1, the DisallowedRawHtml extension can be bypassed by inserting a newline, tab, or other ASCII whitespace character between a disallowed HTML tag name and the closing >. For example, <script\n> would pass through unfiltered and be rendered as a valid HTML tag by browsers. This is a cross-site scripting (XSS) vector for any application that relies on this extension to sanitize untrusted user input. All applications using the DisallowedRawHtml extension to process untrusted markdown are affected. Applications that use a dedicated HTML sanitizer (such as HTML Purifier) on the rendered output are not affected. This issue has been patched in version 2.8.1.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8194-1 advisory.

    It was discovered that league/commonmark did not properly restrict unsafe attributes when the Attributes     extension was enabled. An attacker could possibly use this issue to cause cross-site scripting by     injecting malicious code into rendered HTML. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04     LTS. (CVE-2025-46734)

    It was discovered that league/commonmark did not properly block certain disallowed HTML tags in some     cases. An attacker could possibly use this issue to cause cross-site scripting by inserting malicious HTML     that bypassed filtering. (CVE-2026-30838)

    It was discovered that league/commonmark did not properly enforce domain allowlist checks in the Embed     extension. An attacker could possibly use this issue to bypass domain restrictions and cause untrusted     content to be treated as allowed. This issue only affected Ubuntu 24.04 LTS. (CVE-2026-33347)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - league/commonmark is a PHP Markdown parser. Prior to version 2.8.1, the DisallowedRawHtml extension can be     bypassed by inserting a newline, tab, or other ASCII whitespace character between a disallowed HTML tag     name and the closing >. For example, <script\n> would pass through unfiltered and be rendered as a valid     HTML tag by browsers. This is a cross-site scripting (XSS) vector for any application that relies on this     extension to sanitize untrusted user input. All applications using the DisallowedRawHtml extension to     process untrusted markdown are affected. Applications that use a dedicated HTML sanitizer (such as HTML     Purifier) on the rendered output are not affected. This issue has been patched in version 2.8.1.
    (CVE-2026-30838)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - league/commonmark is a PHP Markdown parser. Prior to version 2.8.1, the DisallowedRawHtml extension can be
    bypassed by inserting a newline, tab, or other ASCII whitespace character between a disallowed HTML tag
    name and the closing >. For example, <script\n> would pass through unfiltered and be rendered as a valid
    HTML tag by browsers. This is a cross-site scripting (XSS) vector for any application that relies on this
    extension to sanitize untrusted user input. All applications using the DisallowedRawHtml extension to
    process untrusted markdown are affected. Applications that use a dedicated HTML sanitizer (such as HTML
    Purifier) on the rendered output are not affected. This issue has been patched in version 2.8.1.
    (CVE-2026-30838)

ID	Name	Product	Family	Type	Severity
309186	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS : league/commonmark vulnerabilities (USN-8194-1)	Nessus	Ubuntu Local Security Checks	Local	medium
301662	Linux Distros Unpatched Vulnerability : CVE-2026-30838	Nessus	Misc.	Local	medium
438477	SCA: security update for league/commonmark (GHSA-4v6x-c7xx-hw9f)	Tenable Cloud Security	SCA Checks	Local	medium
438477	SCA: security update for league/commonmark (GHSA-4v6x-c7xx-hw9f)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-30838

medium

Tenable Plugins

medium

medium

medium

medium