Description

league/commonmark (thephpleague/commonmark) versions >= 2.7.0 and < 2.9.1 contain a cross-site scripting vulnerability in the AttributesExtension. Prefixing an attribute name with a single U+000C form feed byte (e.g. {\x0Conclick="alert(1)"}) bypasses the AttributesHelper::filterAttributes() 'on*' event-handler filter because PHP's trim() does not strip U+000C, causing the attribute to be written verbatim into the output where browsers parse it as a genuine event handler. The same prefix also defeats the allow_unsafe_links check, allowing javascript: URIs through href/src attributes even when allow_unsafe_links is false. Exploitation requires processing untrusted Markdown with the AttributesExtension enabled; the injected script executes when the rendered HTML is viewed. Fixed in 2.9.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-07T13:20:42.460Z",
  "pubdate": "2026-09-07T13:20:42.460Z",
  "executiveSummary": "The AttributesExtension in league/commonmark versions 2.7.0 through 2.9.0 is vulnerable to a Cross-Site Scripting (XSS) exploit caused by insufficient input sanitization. The vulnerability arises because PHP's trim() function fails to remove the U+000C form feed character, allowing malicious actors to bypass security filters.\nBy prefixing attribute names with a U+000C character, an attacker can circumvent the AttributesHelper::filterAttributes() logic intended to block 'on*' event handlers and the allow_unsafe_links security check.\nSuccessful exploitation requires the AttributesExtension to be enabled while processing untrusted Markdown input. When rendered in a web browser, the injected payload executes, leading to potential unauthorized script execution in the context of the user's session.\nThis vulnerability poses a significant risk to applications that rely on league/commonmark for user-generated content rendering. Exploitation does not require authentication, but relies on the ability to submit arbitrary Markdown to the application. The vulnerability is remediated in version 2.9.1.",
  "technicalDetails": "The root cause of this vulnerability lies in an incomplete sanitization routine within the AttributesHelper::filterAttributes() method. The application uses PHP's trim() function to clean attribute names and values; however, trim() does not account for the U+000C (form feed) character. Browsers, conversely, are significantly more permissive and will ignore or interpret this character as whitespace, allowing it to act as an obfuscation layer.\nExploitation involves injecting malicious attributes or URIs into Markdown content processed by the AttributesExtension. By prefixing an attribute name with a U+000C byte, such as in the string '{\\x0Conclick=\"alert(1)\"}', the filter logic perceives the attribute as non-matching any forbidden 'on*' event handler patterns. Because the filter does not strip the U+000C character, the resulting output includes the verbatim, dangerous attribute.\nThe same obfuscation technique bypasses the allow_unsafe_links security check. When this check is enforced, the library is expected to strip 'javascript:' URIs within href or src attributes. The presence of the U+000C prefix prevents the detection logic from identifying the 'javascript:' protocol, allowing the URI to be written into the generated HTML. When a victim views the rendered page, the browser interprets the obfuscated payload as valid HTML, executing the malicious script.\nThe attack flow proceeds as follows: 1) An attacker provides malicious Markdown containing the U+000C prefix to an application utilizing the vulnerable version of league/commonmark. 2) The AttributesExtension processes the input, failing to detect the malicious event handler or unsafe link due to the inadequate trimming of the U+000C character. 3) The malicious HTML is generated and stored or reflected by the application. 4) A user's browser renders the HTML, strips the leading form feed character during parsing, and executes the hidden script within the origin of the vulnerable application.\nThe vulnerability affects all league/commonmark installations using versions >= 2.7.0 and < 2.9.1 where the AttributesExtension is active. No special privileges are required for exploitation beyond the capability to provide Markdown input to the vulnerable component."
}