CVE-2026-86431
HighCVSS 7.2Summary
Cross-site scripting vulnerability in AttributesExtension of league/commonmark versions >= 2.7.0 and < 2.9.1. Prefixing an attribute name with a single U+000C form feed byte bypasses the AttributesHelper::filterAttributes() 'on*' filter because PHP's trim() does not strip U+000C, causing the attribute to be written verbatim into the output where browsers parse it as a genuine event handler. The same prefix also defeats the allow_unsafe_links check, allowing javascript: URIs through href/src attributes even when allow_unsafe_links is false.
Risk Assessment
If untrusted Markdown is processed with AttributesExtension enabled, an attacker can execute script in the victim's browser, potentially leading to data theft or session hijacking.
Recommendation
Update league/commonmark to version 2.9.1 or later.
Other vulnerabilities in league/commonmark
See all- CVE-2026-86434High
Denial of service vulnerability in league/commonmark versions >= 2.0.0 and < 2.8.4 (patched in 2.9.0) in UniqueSlugNormalizer::normalize(). On slug collision, the numeric-suffix search restarts from 1, resulting in O(K^2) time complexity for K headings collapsing to the same base slug. The vulnerable path is reached when HeadingPermalinkExtension, FootnoteExtension, or TableOfContentsExtension is registered.
- CVE-2026-86430High
Multiple denial of service vulnerabilities in league/commonmark before 2.9.1 in fenced code block detection, reference link label lookup, and emphasis delimiter processing that perform super-linear work on crafted input. Attackers can submit specially crafted Markdown with long backtick runs, nested brackets, or delimiter sequences to consume disproportionate CPU time and prevent legitimate requests from completing.
- CVE-2026-86429High
The league/commonmark library in versions >= 1.5.0 and < 2.9.1 contains quadratic parsing complexity in its SmartPunctExtension and AttributesExtension. When either extension is explicitly registered on the Environment (they are not enabled by default and are excluded from the standard CommonMark and GitHub-Flavored Markdown converters), an unauthenticated attacker can submit small, specially crafted Markdown documents — such as text alternating with unpaired quotes, contiguous runs of block-level attribute blocks, or repeated class attributes — to trigger disproportionate CPU consumption and cause a denial of service.
- CVE-2026-71488High
Vulnerability in the PHP library league/commonmark (versions 0.6.0 to 2.9.0) causes quadratic time complexity when parsing specially crafted Markdown lines. An attacker can submit a small request that consumes disproportionate CPU time.
- CVE-2026-71478Medium
league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 1.5.0 until 2.9.0, the AttributesExtension's href and src unsafe-link filter can be bypassed by embedding control bytes, such as a tab, carriage return, line feed, or leading C0 control character, in a javascript: URL that browsers discard before parsing the scheme, causing the browser to still execute the script even when the unsafe-link filter is enabled. This issue is fixed in 2.9.0.
Original NVD description (English source)
league/commonmark (thephpleague/commonmark) versions >= 2.7.0 and < 2.9.1 contain a cross-site scripting vulnerability in the AttributesExtension. Prefixing an attribute name with a single U+000C form feed byte (e.g. {\x0Conclick="alert(1)"}) bypasses the AttributesHelper::filterAttributes() 'on*' event-handler filter because PHP's trim() does not strip U+000C, causing the attribute to be written verbatim into the output where browsers parse it as a genuine event handler. The same prefix also defeats the allow_unsafe_links check, allowing javascript: URIs through href/src attributes even when allow_unsafe_links is false. Exploitation requires processing untrusted Markdown with the AttributesExtension enabled; the injected script executes when the rendered HTML is viewed. Fixed in 2.9.1.