CVE-2026-86431: commonmark before 2.9.1 XSS via AttributesExtension form feed bypass
league/commonmark (thephpleague/commonmark) versions >= 2.7.0 and < 2.9.1 contain a cross-site scripting vulnerability in the AttributesExtension. Prefixing an attribute name with a single U+000C form feed byte (e.g. {\x0Conclick="alert(1)"}) bypasses the AttributesHelper::filterAttributes() 'on' event-handler filter because PHP's trim() does not strip U+000C, causing the attribute to be written verbatim into the output where browsers parse it as a genuine event handler. The same prefix also defeats the allowunsafelinks check, allowing javascript: URIs through href/src attributes even when allowunsafelinks is false. Exploitation requires processing untrusted Markdown with the AttributesExtension enabled; the injected script executes when the rendered HTML is viewed. Fixed in 2.9.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
league/commonmark (thephpleague/commonmark)to a version that resolves this vulnerability.Fixed in 2.9.1 - Configuration
Disable AttributesExtension if it is enabled, since exploitation requires processing untrusted Markdown with AttributesExtension enabled.
AttributesExtension enabled = false
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using league/commonmark versions 2.7.0 through before 2.9.1 are exposed only when the AttributesExtension is enabled and they process untrusted Markdown. The issue affects rendered HTML viewed in a browser.
What does an attacker need to exploit this?
An attacker needs a way to submit Markdown that will be rendered with the AttributesExtension enabled. They can prefix an attribute name with one U+000C form feed byte to bypass filtering of event-handler attributes or unsafe javascript: URIs.
Does disabling unsafe links prevent exploitation?
No. The same form-feed prefix bypasses the allow_unsafe_links check for href or src attributes, allowing javascript: URIs even when allow_unsafe_links is false.
What is the available remediation?
Upgrade league/commonmark to version 2.9.1. If upgrading is not immediately possible, do not process untrusted Markdown with the AttributesExtension enabled.