AIKIDO-2026-941388

TL;DR

The Attributes extension's href and src unsafe-link filter checks each URL against an anchored denylist regex without first normalizing embedded control bytes. Markdown that hides a javascript: scheme with an embedded tab, newline, or leading control character passes the filter unchanged, even when allow_unsafe_links is disabled. Browsers strip those bytes before parsing the scheme, so the crafted link still executes script in a viewer's session. The fix normalizes control characters in the unsafe-link check so obfuscated dangerous schemes are detected and filtered.