CVE-2026-86431

CVE-2026-86431 is a cross-site scripting vulnerability in the PHP Markdown rendering library league/commonmark (versions 2.7.0 through 2.9.0) in which the AttributesExtension's event-handler and unsafe-link filtering can be bypassed by prefixing an attribute name with a single U+000C form feed byte, which PHP's trim() does not strip, so the attribute is written verbatim into the rendered HTML where browsers treat it as a genuine event handler. It is triggered whenever a server processes untrusted Markdown with the AttributesExtension enabled; the same trick also defeats the allow_unsafe_links check, letting javascript: URIs pass through href/src attributes. An attacker who can submit Markdown therefore gains arbitrary script execution in the browser of any user viewing the rendered page, which can lead to session theft or unauthorized actions in the hosting application. Anyone running a PHP application that renders user-supplied Markdown with league/commonmark versions 2.7.0 or newer but below 2.9.1 and the AttributesExtension enabled is affected. A public proof-of-concept and security advisory (GHSA-f8fg-pg57-v4j8) exist, but there is no confirmed in-the-wild exploitation: the flaw is not in CISA KEV and EPSS estimates only about a 0.2% chance of exploitation within 30 days.

What to do: Upgrade league/commonmark to version 2.9.1 or later, which restores correct attribute filtering. Until patched, disable the AttributesExtension for untrusted Markdown, or strip control characters (notably U+000C form feed) from user-supplied Markdown attribute names and validate href/src values to block javascript: URIs; audit whether your application registers AttributesExtension on user-provided input.