AIKIDO-2026-436039
league/html-to-markdown is vulnerable to Cross-Site Scripting (XSS)
50
Medium Risk
This Affects:
league/html-to-markdownTL;DR
LinkConverter and ImageConverter build Markdown links and images by concatenating the element's href/src, title, and alt attribute values without escaping them. A double quote in title, a closing bracket in alt, or an unbalanced closing parenthesis in the URL ends the link or image syntax early, and the entity decoded remainder of the value is emitted as raw Markdown or HTML. HTML Purifier and the strip_tags/remove_nodes options do not stop this because the attribute value contains no tags before conversion runs. The fix escapes link and image text and destinations before they are written into the output.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and the converted Markdown is later rendered to HTML by a renderer that allows raw HTML.
Background info
league/html-to-markdown is vulnerable to Cross-Site Scripting (XSS) in versions 3.0.0 - 5.1.2.
How to fix this
Upgrade the league/html-to-markdown library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.