CVE-2026-71478: thephpleague commonmark XSS bypass in AttributesExtension

CVE-2026-71478 · Severity: medium · CVSS 6.1 · Published 2026-08-06

The league/commonmark library, a popular Markdown parser for PHP, contains a vulnerability in its Attributes extension. An attacker can bypass security filters by embedding hidden characters (like tabs or newlines) into links. This allows them to execute malicious JavaScript in a user's browser, potentially leading to account takeover or theft of sensitive information, even if the library's safety settings are enabled.

Technologies: league/commonmark (Packagist), The PHP League CommonMark. Vendors: Packagist, The PHP League.

Quick answers

Is CVE-2026-71478 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-71478 being exploited in the wild.
How severe is CVE-2026-71478?
Medium severity, with a CVSS score of 6.1, published 6 August 2026.
Which products and versions are affected?
league/commonmark (Packagist) >= 1.5.0, <= 2.8.3, ECOSYSTEM:introduced=1.5.0,fixed=2.9.0; The PHP League CommonMark >= 1.5.0, <= 2.8.3.
Is there a fix for CVE-2026-71478?
Yes. league/commonmark (Packagist): upgrade to 2.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-71478 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-71478?
Check whether you run league/commonmark (Packagist) or The PHP League CommonMark at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • league/commonmark (Packagist): upgrade to 2.9.0 or later
    composer require league/commonmark:^2.9.0

Technical details

A Cross-Site Scripting (XSS) vulnerability exists in the AttributesExtension of league/commonmark due to an incomplete denylist in the link filtering logic. The `AttributesHelper::filterAttributes()` method uses a regex that fails to account for control bytes (such as 0x09 TAB, 0x0D CR, or 0x0A LF) embedded within URI schemes like 'javascript:'. Browsers typically strip these characters before parsing the URL, allowing an attacker to bypass the `isLinkPotentiallyUnsafe` check. This occurs because the Attributes extension does not normalize or percent-encode control bytes before validation, unlike the core Markdown link parser. The vulnerability is present even when `allow_unsafe_links` is set to false. A fix is available in version 2.9.0 which normalizes input before safety checks.

Affected products

  • thephpleague commonmark >= 1.5.0, <= 2.8.3

Identifiers

  • CVE-2026-71478
  • GHSA-29pj-957v-52mc

Timeline

  • 2026-08-03: disclosed
  • 2026-08-03: patched: Version 2.9.0 released
  • 2026-08-06: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.