The vulnerability is a flaw in the DisallowedRawHtml extension for the PHP Markdown parser league/commonmark, where inserting any ASCII whitespace between the tag name and the final ‘>’ bypasses the sanitizer. This allows disallowed tags like <script> to be rendered to the browser, enabling arbitrary JavaScript execution as an XSS vector. The weakness is an instance of CWE‑79, representing unsafe handling of user‑supplied markup.

All installations of thephpleague:commonmark before version 2.8.1 that enable the DisallowedRawHtml extension are affected. This includes any PHP application that processes untrusted Markdown through the parser, such as web frameworks handling comments, posts, or API payloads. Applications that do not use this extension or that apply a separate HTML sanitizer after rendering are not vulnerable.

The CVSS base score of 5.1 indicates moderate severity, while an EPSS score of less than 1 % points to a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw remotely by injecting crafted Markdown containing whitespace‑delimited disallowed tags via any user‑contributed content field. No special privileges or local access are required; the attack vector is typical web‑based user input.