AIKIDO-2026-280543
league/commonmark is vulnerable to Cross-Site Scripting (XSS)
72
High Risk
This Affects:
league/commonmarkTL;DR
The AttributesExtension filters attribute names such as on* event handlers and unsafe href/src values to stop script injection. Prefixing an attribute name with a form-feed byte lets the name survive trim() and slip past those string comparisons, while browsers still treat the byte as whitespace and parse the name as a genuine attribute. This lets untrusted Markdown inject event handlers or javascript: URIs into rendered HTML, resulting in cross-site scripting even under the recommended hardened configuration. The fix rejects malformed attribute names so form-feed-prefixed names can no longer bypass the filter.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you render untrusted Markdown with the AttributesExtension enabled and its attributes.allow list left at the default empty value.
Background info
league/commonmark is vulnerable to Cross-Site Scripting (XSS) in versions 2.7.0 - 2.9.0.
How to fix this
Upgrade the league/commonmark library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.