CVE-2026-71478— league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes
Possible ATT&CK Techniques 1AI
T1189 · Drive-by CompromiseGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-71478
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes
Source: CVE Program / CVE List V5
Vulnerability Description
league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 1.5.0 until 2.9.0, the AttributesExtension's href and src unsafe-link filter can be bypassed by embedding control bytes, such as a tab, carriage return, line feed, or leading C0 control character, in a javascript: URL that browsers discard before parsing the scheme, causing the browser to still execute the script even when the unsafe-link filter is enabled. This issue is fixed in 2.9.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| thephpleague | commonmark | >= 1.5.0, <= 2.8.3 | - |
II. Public POCs for CVE-2026-71478
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-71478
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-71478 (1)
Vendor Advisories for CVE-2026-71478 (1)
Vendor Pages for CVE-2026-71478 (1)
IV. Related Vulnerabilities
Same product: commonmark
Same vendor: thephpleague
- CVE-2026-71488
league/commonmark: Quadratic-time denial of service when par - CVE-2026-33347
league/commonmark has an embed extension allowed_domains byp - CVE-2026-30838
league/commonmark: DisallowedRawHtml extension bypass via wh - CVE-2025-46734
league/commonmark Cross-site Scripting vulnerability in Attr - CVE-2023-37260
league/oauth2-server key exposed in exception message when p
Same weakness: CWE-79
- CVE-2026-48093
Code Embed - Contributor Stored Cross-Site Scripting via Rem - CVE-2026-19209
SourceCodester Photo Share Website index.php home cross site - CVE-2026-19207
PHPGurukul Company Visitor Management System manage-newvisit - CVE-2026-48094
ShareOpenly has Cross-Site Scripting (XSS) via Missing esc_u - CVE-2026-54216
TeamDavid: Reflected Cross Site Scripting (XSS) via the 'Ent
V. Comments for CVE-2026-71478
No comments yet