{"id":"CVE-2026-86431","revision":"99b7393667844980a2b976b4acc82d15","records":[{"revision":"99b7393667844980a2b976b4acc82d15","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-86431","aliases":[],"title":"commonmark before 2.9.1 XSS via AttributesExtension form feed bypass","description":"league/commonmark (thephpleague/commonmark) versions >= 2.7.0 and < 2.9.1 contain a cross-site scripting vulnerability in the AttributesExtension. Prefixing an attribute name with a single U+000C form feed byte (e.g. {\\x0Conclick=\"alert(1)\"}) bypasses the AttributesHelper::filterAttributes() 'on*' event-handler filter because PHP's trim() does not strip U+000C, causing the attribute to be written verbatim into the output where browsers parse it as a genuine event handler. The same prefix also defeats the allow_unsafe_links check, allowing javascript: URIs through href/src attributes even when allow_unsafe_links is false. Exploitation requires processing untrusted Markdown with the AttributesExtension enabled; the injected script executes when the rendered HTML is viewed. Fixed in 2.9.1.","state":0,"publishedAt":"2026-09-07T12:53:51.246+00:00","modifiedAt":"2026-10-08T15:25:52.798+00:00","affected":[{"ecosystem":"Vendor product","name":"commonmark","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"thephpleague\",\n                    \"product\": \"commonmark\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"2.7.0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"2.9.1\"\n                        },\n                        {\n                            \"version\": \"2.9.1\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"packageURL\": \"pkg:composer/league/commonmark\"\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","score":6.9,"severity":"MEDIUM"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","score":7.2,"severity":"HIGH"}],"references":["https://github.com/thephpleague/commonmark/security/advisories/GHSA-f8fg-pg57-v4j8","https://github.com/thephpleague/commonmark/commit/43207253ea5f14867c77c697cd3838c446cadcea","https://www.vulncheck.com/advisories/commonmark-before-2.9.1-xss-via-attributesextension-form-feed-bypass"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-86431","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-86431","identifiers":["CVE-2026-86431"]},"retained":false,"historicalAffected":[]}],"coverage":[]}