Description
league/commonmark (thephpleague/commonmark) versions >= 2.7.0 and < 2.9.1 contain a cross-site scripting vulnerability in the AttributesExtension. Prefixing an attribute name with a single U+000C form feed byte (e.g. {\x0Conclick="alert(1)"}) bypasses the AttributesHelper::filterAttributes() 'on*' event-handler filter because PHP's trim() does not strip U+000C, causing the attribute to be written verbatim into the output where browsers parse it as a genuine event handler. The same prefix also defeats the allow_unsafe_links check, allowing javascript: URIs through href/src attributes even when allow_unsafe_links is false. Exploitation requires processing untrusted Markdown with the AttributesExtension enabled; the injected script executes when the rendered HTML is viewed. Fixed in 2.9.1.
Published: 2026-09-07
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Cross‑Site Scripting
Action: Immediate Patch
AI Analysis

Impact

A cross‑site scripting flaw exists in the CommonMark AttributesExtension. Prefixing an attribute name with a form‑feed byte bypasses the on* event‑handler filter and the allow_unsafe_links check, allowing inline javascript or javascript: URIs to be inserted into the rendered HTML. When a victim loads the generated markup, the injected script executes in the browser, potentially compromising the user’s session and data.

Affected Systems

thephpleague CommonMark library versions from 2.7.0 up to but not including 2.9.1 are affected. Any installation that enables the AttributesExtension to process untrusted Markdown in a web application is vulnerable. Earlier releases and 2.9.1 and later are not known to be affected.

Risk and Exploitability

The vulnerability has a CVSS score of 6.9, indicating moderate severity. The EPSS score is not available, so an estimate of current exploitation probability is not provided. The flaw is not listed in the CISA KEV catalog. An attacker can exploit the issue by crafting Markdown that includes a form‑feed prefixed attribute; execution occurs when users view the rendered HTML in a browser, and no additional privileges are required.

Generated by OpenCVE AI on September 7, 2026 at 15:42 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade CommonMark to version 2.9.1 or later, which resolves the vulnerability.
  • If an upgrade is not feasible, disable or remove the AttributesExtension and ensure that any form‑feed prefixed characters are stripped from attribute names before rendering the HTML.
  • Validate and sanitize all user‑supplied Markdown input to reject or encode form‑feed prefixed attributes, enforce allow_unsafe_links=false, and filter out javascript: URIs.

Generated by OpenCVE AI on September 7, 2026 at 15:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 08 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 07 Sep 2026 13:00:00 +0000

Type Values Removed Values Added
Description league/commonmark (thephpleague/commonmark) versions >= 2.7.0 and < 2.9.1 contain a cross-site scripting vulnerability in the AttributesExtension. Prefixing an attribute name with a single U+000C form feed byte (e.g. {\x0Conclick="alert(1)"}) bypasses the AttributesHelper::filterAttributes() 'on*' event-handler filter because PHP's trim() does not strip U+000C, causing the attribute to be written verbatim into the output where browsers parse it as a genuine event handler. The same prefix also defeats the allow_unsafe_links check, allowing javascript: URIs through href/src attributes even when allow_unsafe_links is false. Exploitation requires processing untrusted Markdown with the AttributesExtension enabled; the injected script executes when the rendered HTML is viewed. Fixed in 2.9.1.
Title commonmark before 2.9.1 XSS via AttributesExtension form feed bypass
First Time appeared Thephpleague
Thephpleague commonmark
Weaknesses CWE-79
CPEs cpe:2.3:a:thephpleague:commonmark:*:*:*:*:*:*:*:*
Vendors & Products Thephpleague
Thephpleague commonmark
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N'}

Subscriptions

Thephpleague Commonmark
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-08T13:33:06.656Z

Reserved: 2026-09-07T12:34:31.457Z

Link: CVE-2026-86431

cve-icon Vulnrichment

Updated: 2026-09-08T13:32:39.362Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-07T13:20:42.460

Modified: 2026-09-09T16:20:39.770

Link: CVE-2026-86431

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-07T15:45:17Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')