Description

league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 1.5.0 until 2.9.0, the AttributesExtension's href and src unsafe-link filter can be bypassed by embedding control bytes, such as a tab, carriage return, line feed, or leading C0 control character, in a javascript: URL that browsers discard before parsing the scheme, causing the browser to still execute the script even when the unsafe-link filter is enabled. This issue is fixed in 2.9.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-06T22:18:31.750Z",
  "pubdate": "2026-08-06T22:18:31.750Z",
  "executiveSummary": "A filter bypass vulnerability exists in the league/commonmark PHP library's AttributesExtension, specifically within the href and src unsafe-link filter mechanism. The vulnerability allows remote attackers to bypass sanitization controls and inject malicious URIs that are subsequently rendered in HTML outputs.\nThe flaw affects league/commonmark versions ranging from 1.5.0 up to, but not including, 2.9.0. Successful exploitation enables cross-site scripting (XSS) attacks by forcing client web browsers to execute malicious script payloads contained within javascript: URLs.\nThe risk implication is severe, as applications utilizing the vulnerable extension to parse untrusted Markdown content will render unsafe links that execute arbitrary JavaScript in the context of the victim's browser session upon interaction.\nAttacker capabilities include crafting specialized Markdown payloads containing obfuscated URIs designed to trick the sanitization filter while remaining executable by modern web browsers.\nExploitation requirements include the rendering of untrusted user input via the AttributesExtension with the unsafe-link filter enabled, and victim interaction such as clicking or loading the rendered malicious link or resource.",
  "technicalDetails": "The root cause of the vulnerability lies in inconsistent URL parsing and sanitization logic between the AttributesExtension's unsafe-link filter and modern web browser rendering engines.\nThe vulnerable component is the AttributesExtension within the league/commonmark library, specifically handling href and src attribute filtering for versions 1.5.0 through 2.9.0.\nAttackers exploit this vulnerability by embedding control bytes—such as horizontal tabs (\\t), carriage returns (\\r), line feeds (\\n), or leading C0 control characters—within a javascript: URL scheme.\nThe step-by-step attack flow proceeds as follows: First, the attacker crafts a malicious Markdown payload utilizing the AttributesExtension syntax to inject a specially formatted URL containing obfuscating control bytes preceding or within the javascript: scheme. Second, the league/commonmark parser evaluates the URL against its unsafe-link filter. Because the filter fails to normalize or strip the embedded control bytes, it incorrectly assumes the URL is safe and permits its inclusion in the generated HTML output. Third, the victim views the rendered HTML within a web browser. Finally, the browser parses the URL, discards the leading control bytes or ignored characters before evaluating the scheme, and executes the embedded JavaScript payload.\nNetwork exposure is inherent to any web application accepting and rendering untrusted Markdown input from remote users.\nAuthentication and privilege requirements are generally none, as the attack vector relies on untrusted user-supplied input processed by the parsing library.\nThe post-exploitation impact includes the execution of arbitrary JavaScript within the security context of the victim's browser, potentially leading to session hijacking, credential theft, or unauthorized actions performed on behalf of the user."
}