league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 1.5.0 until 2.9.0, the AttributesExtension's href and src unsafe-link filter can be bypassed by embedding control bytes, such as a tab, carriage return, line feed, or leading C0 control character, in a javascript: URL that browsers discard before parsing the scheme, causing the browser to still execute the script even when the unsafe-link filter is enabled. This issue is fixed in 2.9.0.
CVE-2025-66606 is a low-severity vulnerability in Yokogawa Electric Corporation's FAST/TOOLS software versions R9.01 to R10.04. The issue stems from improper URL encoding, which could allow an attacker to tamper with web pages or execute malicious scripts via crafted URLs. Exploitation requires user interaction and has a low impact on confidentiality, with no authentication needed but high attack complexity. No known exploits are currently reported in the wild. The vulnerability affects several FAST/TOOLS packages including RVSVRN, UNSVRN, HMIWEB, FTEES, and HMIMOB. European organizations using these versions in industrial control or monitoring environments should be aware but face limited risk due to the low severity and complexity. Mitigation involves applying vendor patches once available, implementing strict input validation, and restricting access to the affected web interfaces. Countries with significant industrial automation sectors using Yokogawa products, such as Germany, France, Italy, and the UK, are more likely to be impacted.
