CVE-2026-71478

league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 1.5.0 until 2.9.0, the AttributesExtension's href and src unsafe-link filter can be bypassed by embedding control bytes, such as a tab, carriage return, line feed, or leading C0 control character, in a javascript: URL that browsers discard before parsing the scheme, causing the browser to still execute the script even when the unsafe-link filter is enabled. This issue is fixed in 2.9.0.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/thephpleague/commonmark/commit/493a5aa7d65754b73846006eaff9c2c4431a8e2c
https://github.com/thephpleague/commonmark/releases/tag/2.9.0
https://github.com/thephpleague/commonmark/security/advisories/GHSA-29pj-957v-52mc
https://github.com/thephpleague/commonmark/security/advisories/GHSA-29pj-957v-52mc

Configurations

No configuration.

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) league/commonmark es una biblioteca PHP para analizar y renderizar CommonMark Markdown. Desde 1.5.0 hasta 2.9.0, el filtro de enlaces no seguros href y src de AttributesExtension puede ser eludido incrustando bytes de control, como un tabulador, retorno de carro, salto de línea o un carácter de control C0 inicial, en una URL javascript_disabled: que los navegadores descartan antes de analizar el esquema, haciendo que el navegador siga ejecutando el script incluso cuando el filtro de enlaces no seguros está habilitado. Este problema está solucionado en 2.9.0.

Information

Published : 2026-08-06 22:18

Updated : 2026-10-24 15:10

NVD link : CVE-2026-71478

Mitre link : CVE-2026-71478

CVE.ORG link : CVE-2026-71478

JSON object : View

Products Affected

No product.

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-86

Improper Neutralization of Invalid Characters in Identifiers in Web Pages

CWE-692

Incomplete Denylist to Cross-Site Scripting

{"id": "CVE-2026-71478", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71478", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-07T17:04:55.894840Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "thephpleague", "product": "commonmark", "versions": [{"status": "affected", "version": ">= 1.5.0, <= 2.8.3"}]}]}], "published": "2026-08-06T22:18:31.750", "references": [{"url": "https://github.com/thephpleague/commonmark/commit/493a5aa7d65754b73846006eaff9c2c4431a8e2c", "source": "security-advisories@github.com"}, {"url": "https://github.com/thephpleague/commonmark/releases/tag/2.9.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/thephpleague/commonmark/security/advisories/GHSA-29pj-957v-52mc", "source": "security-advisories@github.com"}, {"url": "https://github.com/thephpleague/commonmark/security/advisories/GHSA-29pj-957v-52mc", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-86"}, {"lang": "en", "value": "CWE-692"}]}], "descriptions": [{"lang": "en", "value": "league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 1.5.0 until 2.9.0, the AttributesExtension's href and src unsafe-link filter can be bypassed by embedding control bytes, such as a tab, carriage return, line feed, or leading C0 control character, in a javascript: URL that browsers discard before parsing the scheme, causing the browser to still execute the script even when the unsafe-link filter is enabled. This issue is fixed in 2.9.0."}, {"lang": "es", "value": "league/commonmark es una biblioteca PHP para analizar y renderizar CommonMark Markdown. Desde 1.5.0 hasta 2.9.0, el filtro de enlaces no seguros href y src de AttributesExtension puede ser eludido incrustando bytes de control, como un tabulador, retorno de carro, salto de l\u00ednea o un car\u00e1cter de control C0 inicial, en una URL javascript_disabled: que los navegadores descartan antes de analizar el esquema, haciendo que el navegador siga ejecutando el script incluso cuando el filtro de enlaces no seguros est\u00e1 habilitado. Este problema est\u00e1 solucionado en 2.9.0."}], "lastModified": "2026-10-24T15:10:00.190", "sourceIdentifier": "security-advisories@github.com"}