Quick answers
- Is CVE-2025-46734 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-46734 being exploited in the wild.
- How severe is CVE-2025-46734?
- Medium severity, with a CVSS score of 6.4, published 5 May 2025.
- Which products and versions are affected?
- league/commonmark (Packagist) >= 1.5.0, < 2.7.0, ECOSYSTEM:introduced=1.5.0,fixed=2.7.0; The PHP League CommonMark >= 1.5.0, < 2.7.0.
- Is there a fix for CVE-2025-46734?
- Yes. league/commonmark (Packagist): upgrade to 2.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2025-46734 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2025-46734?
- Check whether you run league/commonmark (Packagist) or The PHP League CommonMark at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- league/commonmark (Packagist): upgrade to 2.7.0 or later
composer require league/commonmark:^2.7.0
Technical details
A cross-site scripting (XSS) vulnerability exists in the Attributes extension of the league/commonmark library (versions 1.5.0 through 2.6.x). While the library offers 'strip' and 'allow_unsafe_links' configurations to mitigate XSS, the Attributes extension allows users to inject arbitrary HTML attributes using curly brace syntax (e.g., {onerror=...}). An attacker can use this to bypass filters and execute JavaScript on page load. The vulnerability is addressed in version 2.7.0 by blocking 'on*' attributes by default, introducing an attribute allowlist, and ensuring manually added links respect existing safety configurations.
Affected products
- league commonmark >= 1.5.0, < 2.7.0
Identifiers
- CVE-2025-46734
- GHSA-3527-qv2q-pfvx
Timeline
- 2025-05-05: disclosed
- 2025-05-05: advisory
- 2025-05-05: patched: Fixed in version 2.7.0