CVE-2026-86431: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in thephpleague commonmark

Thephpleague/commonmark versions >=2.7.0 and <2.9.1 contain a cross-site scripting vulnerability in the AttributesExtension. The issue arises because prefixing an attribute name with a U+000C form feed byte bypasses the AttributesHelper::filterAttributes() 'on*' event-handler filter due to PHP's trim() function not removing this character. This allows malicious attributes such as event handlers (e.g., onclick) to be injected verbatim into the output HTML. Additionally, this prefix bypasses the allow_unsafe_links check, permitting javascript: URIs through href/src attributes even when unsafe links are disallowed. Exploitation requires processing untrusted Markdown with the AttributesExtension enabled, and the injected script executes when the rendered HTML is viewed. The vulnerability is fixed in version 2.9.1.

Successful exploitation can lead to cross-site scripting attacks, allowing an attacker to execute arbitrary scripts in the context of the victim's browser when viewing rendered Markdown content. This can result in session hijacking, defacement, or other malicious actions depending on the script payload. The vulnerability affects unauthenticated users processing untrusted Markdown with the vulnerable versions and AttributesExtension enabled.

Upgrade thephpleague/commonmark to version 2.9.1 or later, where this vulnerability is fixed. Until upgraded, avoid processing untrusted Markdown with the AttributesExtension enabled. Patch status is confirmed fixed in 2.9.1.