CVE-2026-86431 in commonmark
Summary
by MITRE • 09/07/2026
league/commonmark (thephpleague/commonmark) versions >= 2.7.0 and < 2.9.1 contain a cross-site scripting vulnerability in the AttributesExtension. Prefixing an attribute name with a single U+000C form feed byte (e.g. {\x0Conclick="alert(1)"}) bypasses the AttributesHelper::filterAttributes() 'on*' event-handler filter because PHP's trim() does not strip U+000C, causing the attribute to be written verbatim into the output where browsers parse it as a genuine event handler. The same prefix also defeats the allow_unsafe_links check, allowing javascript: URIs through href/src attributes even when allow_unsafe_links is false. Exploitation requires processing untrusted Markdown with the AttributesExtension enabled; the injected script executes when the rendered HTML is viewed. Fixed in 2.9.1.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/07/2026
The vulnerability identified in league/commonmark versions greater than or equal to 2.7.0 and less than 2.9.1 represents a significant security flaw within the AttributesExtension component of this popular PHP Markdown parser. This library is widely used for converting Markdown text into HTML, often handling user-generated content from untrusted sources such as forum posts, blog comments, or documentation submissions. The core issue stems from an insufficient input validation mechanism in the AttributesHelper::filterAttributes() method, which fails to properly sanitize attribute names that are prefixed with a specific control character: the U+000C form feed byte. This oversight allows malicious actors to inject executable JavaScript code into the rendered HTML output through crafted Markdown inputs, leading directly to Cross-Site Scripting attacks.
The technical root cause lies in how PHP's trim() function interacts with non-standard whitespace characters during attribute name processing. The AttributesExtension relies on this function to strip surrounding whitespace from attribute names before applying security filters. However, PHP's trim() only removes standard ASCII whitespace characters such as spaces, tabs, and newlines; it does not remove the U+000C form feed byte. Consequently, when an attacker prefixes an event handler attribute name with a single U+000C character, for example by writing {\x0Conclick="alert(1)"} in Markdown syntax, the parser retains this prefix during initial processing steps but ultimately writes the resulting string verbatim into the HTML output because the subsequent filtering logic fails to recognize or block it. Modern web browsers interpret attribute names with leading control characters as valid event handlers due to their permissive parsing rules, thereby executing the injected script when a victim views the rendered page.
Beyond direct XSS via event handlers, this vulnerability also impacts link sanitization mechanisms. The same U+000C prefix technique defeats the allow_unsafe_links configuration check within the library. When developers configure the parser with allow_unsafe_links set to false to prevent the rendering of potentially dangerous protocols like javascript:, an attacker can bypass this restriction by embedding a malicious URI inside href or src attributes prefixed with the form feed byte. This allows the injection of javascript: URIs that execute arbitrary code in the context of the victim's browser, effectively neutralizing one of the primary defenses against script-based attacks embedded within links and images.
The operational impact of this vulnerability is severe for applications relying on league/commonmark to process untrusted input while maintaining strict security policies regarding HTML attributes. Successful exploitation enables attackers to steal session cookies, hijack user sessions, deface websites, or perform actions on behalf of authenticated users without their knowledge. Since the attack vector involves processing Markdown content, it affects any web application that accepts user-supplied text and renders it using this library with the AttributesExtension enabled. The persistence of the vulnerability across multiple minor versions highlights a systemic issue in how control characters are handled during attribute sanitization rather than an isolated coding error.
Mitigation strategies must prioritize immediate upgrading to version 2.9.1 or later, where the developers have addressed these input validation gaps by ensuring that all non-standard whitespace and control characters are properly stripped from attribute names before they reach the filtering logic. For organizations unable to upgrade immediately due to dependency constraints, implementing a pre-processing step to strip U+000C bytes from Markdown content before passing it to the parser serves as an effective workaround. Additionally, developers should ensure that Content Security Policy headers are configured with strict directives to mitigate potential damage in case of future vulnerabilities or incomplete patches.
From a classification perspective, this vulnerability aligns with CWE-79: Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. Specifically, it falls under the subcategory of stored XSS if the malicious Markdown is saved and later rendered for other users. In terms of offensive security frameworks, this exploit maps to MITRE ATT&CK technique T1059: Command and Scripting Interpreter via browser-based execution, leveraging user interaction with rendered content to trigger script execution. The failure also reflects CWE-20: Improper Input Validation where the application fails to adequately validate or sanitize input data containing special characters that could alter program flow or output structure.