Executive brief
The league/commonmark library, a popular Markdown parser for PHP, contains a vulnerability in its Attributes extension. An attacker can bypass security filters by embedding hidden characters (like tabs or newlines) into links. This allows them to execute malicious JavaScript in a user's browser, potentially leading to account takeover or theft of sensitive information, even if the library's safety settings are enabled.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in the AttributesExtension of league/commonmark due to an incomplete denylist in the link filtering logic. The `AttributesHelper::filterAttributes()` method uses a regex that fails to account for control bytes (such as 0x09 TAB, 0x0D CR, or 0x0A LF) embedded within URI schemes like 'javascript:'. Browsers typically strip these characters before parsing the URL, allowing an attacker to bypass the `isLinkPotentiallyUnsafe` check. This occurs because the Attributes extension does not normalize or percent-encode control bytes before validation, unlike the core Markdown link parser. The vulnerability is present even when `allow_unsafe_links` is set to false. A fix is available in version 2.9.0 which normalizes input before safety checks.
Affected products
- thephpleague commonmark >= 1.5.0, <= 2.8.3
Timeline
- 2026-08-03: disclosed
- 2026-08-03: patched: Version 2.9.0 released
- 2026-08-06: advisory