CyberRota Analysis
AI-GeneratedThe AttributesExtension in league/commonmark versions 2.7.0 to 2.9.0 is vulnerable to cross-site scripting (XSS) due to improper filtering of attribute names, allowing attackers to inject malicious scripts into rendered HTML. This vulnerability can be exploited when untrusted Markdown is processed, leading to potential execution of arbitrary JavaScript in users' browsers. Organizations using affected versions should prioritize upgrading to version 2.9.1 or later to mitigate the risk of XSS attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
league/commonmark (thephpleague/commonmark) versions >= 2.7.0 and < 2.9.1 contain a cross-site scripting vulnerability in the AttributesExtension. Prefixing an attribute name with a single U+000C form feed byte (e.g. {\x0Conclick="alert(1)"}) bypasses the AttributesHelper::filterAttributes() 'on*' event-handler filter because PHP's trim() does not strip U+000C, causing the attribute to be written verbatim into the output where browsers parse it as a genuine event handler. The same prefix also defeats the allow_unsafe_links check, allowing javascript: URIs through href/src attributes even when allow_unsafe_links is false. Exploitation requires processing untrusted Markdown with the AttributesExtension enabled; the injected script executes when the rendered HTML is viewed. Fixed in 2.9.1.
Related CVEs
Other vulnerabilities affecting the same vendor(s)