CVE-2018-20583: XSS
Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library versions 0.15.6 through 0.18.x before 0.18.1 allows remote attackers to insert unsafe URLs into HTML (even if allowunsafelinks is false) via a newline character (e.g., writing javascript as javascri%0apt).
Other sources
XSS vulnerability with unsafe link protocols
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-20583?
CVE-2018-20583 is a Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library versions 0.15.6 through 0.18.x before 0.18.1.
What is the severity of CVE-2018-20583?
The severity of CVE-2018-20583 is medium with a severity value of 6.1.
How does CVE-2018-20583 affect the PHP League CommonMark library?
CVE-2018-20583 allows remote attackers to insert unsafe URLs into HTML, even if allow_unsafe_links is set to false, via a newline character.
How can I fix CVE-2018-20583?
To fix CVE-2018-20583, you need to update the PHP League CommonMark library to version 0.18.1 or later.
What is the Common Weakness Enumeration (CWE) of CVE-2018-20583?
The CWE of CVE-2018-20583 is CWE-79, which refers to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').