CVE-2026-86431: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in thephpleague commonmark

Thephpleague/commonmark versions >=2.7.0 and <2.9.1 contain a cross-site scripting vulnerability in the AttributesExtension. Specifically, prefixing an attribute name with a U+000C form feed character bypasses the AttributesHelper::filterAttributes() 'on*' event-handler filter because PHP's trim() function does not remove this character. This allows an attacker to inject event handlers (e.g., onclick) that execute arbitrary scripts. Additionally, the same prefix bypasses the allow_unsafe_links check, permitting javascript: URIs in href/src attributes even when unsafe links are disallowed. Exploitation requires processing untrusted Markdown with the AttributesExtension enabled, and the injected script executes upon rendering the HTML. The vulnerability is fixed in version 2.9.1.

Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the context of the victim's browser when viewing rendered Markdown content. This can lead to typical XSS impacts such as session hijacking, defacement, or redirection. The vulnerability affects applications that process untrusted Markdown with the AttributesExtension enabled and do not sanitize input beyond the flawed filtering.

Upgrade thephpleague/commonmark to version 2.9.1 or later, where this vulnerability is fixed. Until upgrading, avoid processing untrusted Markdown with the AttributesExtension enabled or implement additional input sanitization to block form feed characters in attribute names. No other official fixes or temporary mitigations are documented.