Command Injection via Control Bytes in CommonMark

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: GitHub, Inc.

Description

league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 1.5.0 until 2.9.0, the AttributesExtension's href and src unsafe-link filter can be bypassed by embedding control bytes, such as a tab, carriage return, line feed, or leading C0 control character, in a javascript: URL that browsers discard before parsing the scheme, causing the browser to still execute the script even when the unsafe-link filter is enabled. This issue is fixed in 2.9.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-71478

Affected Vendors & Products

Vendor	Product	Version / Range
league	commonmark	to 2.9.0 (inc)
league	commonmark	2.9.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-692	The product uses a denylist-based protection mechanism to defend against XSS attacks, but the denylist is incomplete, allowing XSS variants to succeed.
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-86	The product does not neutralize or incorrectly neutralizes invalid characters or byte sequences in the middle of tag names, URI schemes, and other identifiers.

Attack-Flow Graph

Executive Summary

This vulnerability affects the league/commonmark PHP library used for parsing and rendering CommonMark Markdown. It allows bypassing the unsafe-link filter in the AttributesExtension by embedding control bytes like tabs or line feeds in a javascript: URL. Browsers ignore these bytes, causing the script to execute despite the filter.

Impact Analysis

If you use the affected versions of league/commonmark (1.5.0 to 2.9.0), an attacker could craft malicious Markdown links that bypass security filters. This could lead to cross-site scripting (XSS) attacks when the Markdown is rendered in a browser, potentially stealing data or executing unauthorized actions.

Mitigation Strategies

Update league/commonmark to version 2.9.0 or later to address the vulnerability in the AttributesExtension's unsafe-link filter.

Hi! I’m here to help you understand CVE-2026-71478. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70