Executive brief
The CommonMark library's AttributesExtension is vulnerable to stored cross-site scripting (XSS) when processing untrusted Markdown with event-handler filtering enabled. An attacker can inject a U+000C form feed character before event handler attribute names (like `onclick` or `onerror`) or unsafe JavaScript URIs, bypassing the security filters that are supposed to block these dangerous attributes. The malicious code executes in browsers without any user interaction, affecting any application that renders user-supplied Markdown with the extension enabled and default settings.
Technical details
The vulnerability is a stored XSS in the `AttributesExtension` component, introduced when the 2.7.0 security release added `filterAttributes()` to block `on*` event handlers and `javascript:` URIs. The flaw exploits three separate behaviors: (1) PHP's `trim()` function excludes U+000C from its default character list, so a form feed prefix survives the regex parsing and embedding in the attribute name; (2) the filter's string comparisons (`str_starts_with($name, 'on')`) fail to match when the name begins with `\x0C`; (3) the HTML renderer outputs attribute names without escaping, and browsers' HTML5 tokenizer treats `\x0C` as whitespace, parsing `\x0Conclick` as a genuine `onclick` handler. Exploitation requires no authentication and affects the default configuration where `attributes.allow` is empty. Payloads can be attached to images using `onerror`, firing on page load without user interaction. A patch (2.9.1) is available.
Affected products
- The PHP League CommonMark 2.7.0 through 2.9.0
Timeline
- 2026-08-09: disclosed: Initially reported; published 2026-09-01
- 2026-09-01: patched: Fixed in version 2.9.1