# CVE-2026-71478: thephpleague commonmark XSS bypass in AttributesExtension

Source: https://junglewise.ai/threats/cve-2026-71478-thephpleague-commonmark-xss-bypass-in-attributesextension  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-06. Updated: 2026-08-06  
License: CC BY 4.0 with a link back

CVE-2026-71478 · Severity: medium · CVSS 6.1 · Published 2026-08-06

The league/commonmark library, a popular Markdown parser for PHP, contains a vulnerability in its Attributes extension. An attacker can bypass security filters by embedding hidden characters (like tabs or newlines) into links. This allows them to execute malicious JavaScript in a user's browser, potentially leading to account takeover or theft of sensitive information, even if the library's safety settings are enabled.

Technologies: [league/commonmark (Packagist)](https://junglewise.ai/threats/technologies/league-commonmark), [The PHP League CommonMark](https://junglewise.ai/threats/technologies/commonmark). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [The PHP League](https://junglewise.ai/threats/vendors/the-php-league).

## Quick answers

**Is CVE-2026-71478 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-71478 being exploited in the wild.

**How severe is CVE-2026-71478?** Medium severity, with a CVSS score of 6.1, published 6 August 2026.

**Which products and versions are affected?** league/commonmark (Packagist) >= 1.5.0, <= 2.8.3, ECOSYSTEM:introduced=1.5.0,fixed=2.9.0; The PHP League CommonMark >= 1.5.0, <= 2.8.3.

**Is there a fix for CVE-2026-71478?** Yes. league/commonmark (Packagist): upgrade to 2.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-71478 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-71478?** Check whether you run league/commonmark (Packagist) or The PHP League CommonMark at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- league/commonmark (Packagist): upgrade to 2.9.0 or later

  ```sh
  composer require league/commonmark:^2.9.0
  ```


## Technical details

A Cross-Site Scripting (XSS) vulnerability exists in the AttributesExtension of league/commonmark due to an incomplete denylist in the link filtering logic. The `AttributesHelper::filterAttributes()` method uses a regex that fails to account for control bytes (such as 0x09 TAB, 0x0D CR, or 0x0A LF) embedded within URI schemes like 'javascript:'. Browsers typically strip these characters before parsing the URL, allowing an attacker to bypass the `isLinkPotentiallyUnsafe` check. This occurs because the Attributes extension does not normalize or percent-encode control bytes before validation, unlike the core Markdown link parser. The vulnerability is present even when `allow_unsafe_links` is set to false. A fix is available in version 2.9.0 which normalizes input before safety checks.

## Affected products

- thephpleague commonmark >= 1.5.0, <= 2.8.3

## Identifiers

- CVE-2026-71478
- GHSA-29pj-957v-52mc

## Timeline

- 2026-08-03: disclosed
- 2026-08-03: patched: Version 2.9.0 released
- 2026-08-06: advisory

## References

- [https://api.github.com/users/TungNGo02](https://api.github.com/users/TungNGo02)
- [https://github.com/TungNGo02](https://github.com/TungNGo02)
- [https://api.github.com/users/TungNGo02/gists%7B/gist_id%7D](https://api.github.com/users/TungNGo02/gists%7B/gist_id%7D)
- [https://api.github.com/users/TungNGo02/repos](https://api.github.com/users/TungNGo02/repos)
- [https://avatars.githubusercontent.com/u/89920429?v=4](https://avatars.githubusercontent.com/u/89920429?v=4)
- [https://api.github.com/users/TungNGo02/events%7B/privacy%7D](https://api.github.com/users/TungNGo02/events%7B/privacy%7D)

## Related threats

- [league/commonmark DisallowedRawHtml XSS bypass in tag parsing](https://junglewise.ai/threats/league-commonmark-disallowedrawhtml-bypassed-when-a-disallowed-tag-name-cea607bc)
- [league/commonmark quadratic DoS in GitHub Flavored Markdown table parser](https://junglewise.ai/threats/league-commonmark-quadratic-time-denial-of-service-in-the-github-a4135205)
- [league/commonmark polynomial time complexity denial of service](https://junglewise.ai/threats/cve-2024-58382-league-commonmark-polynomial-time-complexity-denial-of-service)
- [commonmark Footnote extension denial of service](https://junglewise.ai/threats/cve-2026-86435-commonmark-footnote-extension-denial-of-service)
- [commonmark XmlRenderer denial of service via nested XML indentation](https://junglewise.ai/threats/cve-2026-86432-commonmark-xmlrenderer-denial-of-service-via-nested-xml)