The vulnerability lies in the AttributesExtension of the PHP library, where control bytes such as tabs, carriage returns, line feeds, or leading C0 control characters can be embedded in a javascript: URL. Browsers discard these bytes before parsing the scheme, so the unsafe-link filter is bypassed and the script still executes. The result is a cross‑site scripting (XSS) attack that can compromise confidentiality, integrity, and availability of client‑side data. The weakness corresponds to CWE‑692, CWE‑79, and CWE‑86 – improper handling of escape characters, input validation failures, and unsafe script execution.

Thephpleague’s commonmark library versions from 1.5.0 through and including 2.9.0 are affected. The rendering of markdown that passes through the AttributesExtension without updating to 2.9.0 or later allows the bypass. Vendors and developers using these library versions in web applications should verify the installed version and consider upgrading.

With a CVSS score of 6.1 the vulnerability is of moderate severity. The EPSS score is unavailable, and the vulnerability is not listed in CISA KEV catalogs at this time. The most likely attack vector involves an attacker supplying malicious markdown content to an application that renders it with the AttributesExtension enabled. The control‑byte trick means the browser will execute the embedded javascript, allowing the attacker to hijack the user session, steal credentials, or perform other client‑side malicious actions. No additional exploitation conditions are disclosed; the vulnerability can be triggered by any user who can submit content that the application renders.