CVE-2026-71478

Name of the Vulnerable Software and Affected Versions league/commonmark versions 1.5.0 through 2.8.3

Description The AttributesExtension in the library contains a flaw where the href and src unsafe-link filters can be bypassed. This occurs because the filterAttributes() function and the isLinkPotentiallyUnsafe() check do not normalize control bytes before validating the URL scheme. An attacker can embed control bytes—such as tabs (0x09), carriage returns (0x0D), line feeds (0x0A), or leading C0 control characters—within a javascript: URL. Since browsers discard these characters before parsing the scheme, the script is executed even when the allow unsafe links setting is disabled.

Technical details include:

Recommendations Update league/commonmark to version 2.9.0. As a temporary mitigation, restrict the use of the AttributesExtension or avoid allowing untrusted users to provide attribute values for href and src until the update is applied.