# CVE-2025-46734: league/commonmark XSS in Attributes extension

Source: https://junglewise.ai/threats/cve-2025-46734-league-commonmark-xss-in-attributes-extension  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-05-05. Updated: 2026-05-28  
License: CC BY 4.0 with a link back

CVE-2025-46734 · Severity: medium · CVSS 6.4 · Published 2025-05-05

The league/commonmark library, a popular tool for converting Markdown text into HTML, contains a vulnerability in its Attributes extension. This flaw allows attackers to bypass security settings and inject malicious JavaScript into web pages. If exploited, this could lead to unauthorized actions being performed in a user's browser, potentially compromising user data or session security.

Technologies: [league/commonmark (Packagist)](https://junglewise.ai/threats/technologies/league-commonmark), [The PHP League CommonMark](https://junglewise.ai/threats/technologies/commonmark). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [The PHP League](https://junglewise.ai/threats/vendors/the-php-league).

## Quick answers

**Is CVE-2025-46734 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-46734 being exploited in the wild.

**How severe is CVE-2025-46734?** Medium severity, with a CVSS score of 6.4, published 5 May 2025.

**Which products and versions are affected?** league/commonmark (Packagist) >= 1.5.0, < 2.7.0, ECOSYSTEM:introduced=1.5.0,fixed=2.7.0; The PHP League CommonMark >= 1.5.0, < 2.7.0.

**Is there a fix for CVE-2025-46734?** Yes. league/commonmark (Packagist): upgrade to 2.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-46734 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-46734?** Check whether you run league/commonmark (Packagist) or The PHP League CommonMark at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- league/commonmark (Packagist): upgrade to 2.7.0 or later

  ```sh
  composer require league/commonmark:^2.7.0
  ```


## Technical details

A cross-site scripting (XSS) vulnerability exists in the Attributes extension of the league/commonmark library (versions 1.5.0 through 2.6.x). While the library offers 'strip' and 'allow_unsafe_links' configurations to mitigate XSS, the Attributes extension allows users to inject arbitrary HTML attributes using curly brace syntax (e.g., {onerror=...}). An attacker can use this to bypass filters and execute JavaScript on page load. The vulnerability is addressed in version 2.7.0 by blocking 'on*' attributes by default, introducing an attribute allowlist, and ensuring manually added links respect existing safety configurations.

## Affected products

- league commonmark >= 1.5.0, < 2.7.0

## Identifiers

- CVE-2025-46734
- GHSA-3527-qv2q-pfvx

## Timeline

- 2025-05-05: disclosed
- 2025-05-05: advisory
- 2025-05-05: patched: Fixed in version 2.7.0

## References

- [https://api.github.com/users/TRIKKSS](https://api.github.com/users/TRIKKSS)
- [https://github.com/TRIKKSS](https://github.com/TRIKKSS)
- [https://api.github.com/users/TRIKKSS/gists%7B/gist_id%7D](https://api.github.com/users/TRIKKSS/gists%7B/gist_id%7D)
- [https://api.github.com/users/TRIKKSS/repos](https://api.github.com/users/TRIKKSS/repos)
- [https://avatars.githubusercontent.com/u/57565036?v=4](https://avatars.githubusercontent.com/u/57565036?v=4)
- [https://api.github.com/users/TRIKKSS/events%7B/privacy%7D](https://api.github.com/users/TRIKKSS/events%7B/privacy%7D)

## Related threats

- [league/commonmark DisallowedRawHtml XSS bypass in tag parsing](https://junglewise.ai/threats/league-commonmark-disallowedrawhtml-bypassed-when-a-disallowed-tag-name-cea607bc)
- [league/commonmark quadratic DoS in GitHub Flavored Markdown table parser](https://junglewise.ai/threats/league-commonmark-quadratic-time-denial-of-service-in-the-github-a4135205)
- [league/commonmark polynomial time complexity denial of service](https://junglewise.ai/threats/cve-2024-58382-league-commonmark-polynomial-time-complexity-denial-of-service)
- [commonmark Footnote extension denial of service](https://junglewise.ai/threats/cve-2026-86435-commonmark-footnote-extension-denial-of-service)
- [commonmark XmlRenderer denial of service via nested XML indentation](https://junglewise.ai/threats/cve-2026-86432-commonmark-xmlrenderer-denial-of-service-via-nested-xml)