CVE-2026-71478 in Commonmark
Summary
by MITRE • 08/07/2026
league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 1.5.0 until 2.9.0, the AttributesExtension's href and src unsafe-link filter can be bypassed by embedding control bytes, such as a tab, carriage return, line feed, or leading C0 control character, in a javascript: URL that browsers discard before parsing the scheme, causing the browser to still execute the script even when the unsafe-link filter is enabled. This issue is fixed in 2.9.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
The vulnerability resides within the league/commonmark PHP library's AttributesExtension functionality, specifically affecting versions between 1.5.0 and 2.9.0. This represents a classic cross-site scripting attack vector that exploits how browsers handle URL parsing and control character interpretation. The flaw exists in the unsafe-link filter implementation that is designed to prevent execution of javascript: URLs within href and src attributes. However, attackers can bypass this protection mechanism by embedding C0 control characters such as tab (0x09), carriage return (0x0D), line feed (0x0A), or other leading control bytes within the javascript: URL itself. These control characters are automatically stripped by browsers during the URL parsing process before the scheme is evaluated, effectively allowing malicious scripts to execute despite the filter being enabled.
The technical nature of this vulnerability aligns with CWE-79 Cross-Site Scripting and CWE-154 Control Character Handling issues, where improper handling of control characters in input validation creates exploitable conditions. The attack leverages browser behavior where certain control characters are silently removed from URLs during parsing, leaving only the javascript: scheme portion that can still trigger script execution. This bypass mechanism operates at the protocol level where browsers normalize URLs by removing control characters before scheme evaluation, creating a mismatch between the library's expectation of safe URL handling and actual browser behavior.
From an operational impact perspective, this vulnerability allows attackers to inject malicious JavaScript code into web pages rendered using the affected library versions. When users view content containing crafted markdown with embedded javascript: URLs that include control characters, their browsers will execute the malicious scripts without proper filtering. This creates a persistent threat vector for websites relying on commonmark for content rendering, potentially enabling session hijacking, data theft, or defacement attacks against end users. The vulnerability affects any web application using the AttributesExtension with href or src attributes where user input is rendered through the affected library versions.
The mitigation strategy requires immediate upgrade to version 2.9.0 or later, which implements proper control character handling in the unsafe-link filtering mechanism. Organizations should also conduct thorough code reviews of all markdown rendering components and implement additional input sanitization measures beyond the library's built-in protections. Security teams should monitor for potential exploitation attempts through automated scanning tools that can detect malformed javascript: URLs with embedded control characters. The fix addresses the root cause by ensuring proper URL normalization and validation regardless of control character presence, preventing the browser-level bypass that previously enabled script execution.
This vulnerability demonstrates the importance of understanding browser-level URL parsing behavior when implementing security controls, as the library's filtering logic was designed without accounting for how browsers handle C0 control characters during URL normalization. The issue represents a gap in the principle of least privilege where the filter's design assumption about URL handling was incorrect, creating an attack surface that could be exploited by adversaries familiar with browser URL parsing quirks. The ATT&CK framework categorizes this under T1566 Credential Access and T1203 Exploitation for Client Execution, highlighting its potential for both privilege escalation and persistent access through malicious script execution in user browsers.