CVE-2026-71478

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-71478", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-06T19:56:23.724Z", "datePublished": "2026-08-06T20:30:32.045Z", "dateUpdated": "2026-08-07T17:05:57.244Z"}, "containers": {"cna": {"title": "league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-86", "lang": "en", "description": "CWE-86: Improper Neutralization of Invalid Characters in Identifiers in Web Pages", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-692", "lang": "en", "description": "CWE-692: Incomplete Denylist to Cross-Site Scripting", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/thephpleague/commonmark/security/advisories/GHSA-29pj-957v-52mc", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/thephpleague/commonmark/security/advisories/GHSA-29pj-957v-52mc"}, {"name": "https://github.com/thephpleague/commonmark/commit/493a5aa7d65754b73846006eaff9c2c4431a8e2c", "tags": ["x_refsource_MISC"], "url": "https://github.com/thephpleague/commonmark/commit/493a5aa7d65754b73846006eaff9c2c4431a8e2c"}, {"name": "https://github.com/thephpleague/commonmark/releases/tag/2.9.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/thephpleague/commonmark/releases/tag/2.9.0"}], "affected": [{"vendor": "thephpleague", "product": "commonmark", "versions": [{"version": ">= 1.5.0, <= 2.8.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-06T20:30:32.045Z"}, "descriptions": [{"lang": "en", "value": "league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 1.5.0 until 2.9.0, the AttributesExtension's href and src unsafe-link filter can be bypassed by embedding control bytes, such as a tab, carriage return, line feed, or leading C0 control character, in a javascript: URL that browsers discard before parsing the scheme, causing the browser to still execute the script even when the unsafe-link filter is enabled. This issue is fixed in 2.9.0."}], "source": {"advisory": "GHSA-29pj-957v-52mc", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/thephpleague/commonmark/security/advisories/GHSA-29pj-957v-52mc", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-07T17:04:55.894840Z", "id": "CVE-2026-71478", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-07T17:05:57.244Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-71478", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-07T17:04:55.894840Z"}}}], "references": [{"url": "https://github.com/thephpleague/commonmark/security/advisories/GHSA-29pj-957v-52mc", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-07T17:05:41.139Z"}}], "cna": {"title": "league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes", "source": {"advisory": "GHSA-29pj-957v-52mc", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "thephpleague", "product": "commonmark", "versions": [{"status": "affected", "version": ">= 1.5.0, <= 2.8.3"}]}], "references": [{"url": "https://github.com/thephpleague/commonmark/security/advisories/GHSA-29pj-957v-52mc", "name": "https://github.com/thephpleague/commonmark/security/advisories/GHSA-29pj-957v-52mc", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/thephpleague/commonmark/commit/493a5aa7d65754b73846006eaff9c2c4431a8e2c", "name": "https://github.com/thephpleague/commonmark/commit/493a5aa7d65754b73846006eaff9c2c4431a8e2c", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/thephpleague/commonmark/releases/tag/2.9.0", "name": "https://github.com/thephpleague/commonmark/releases/tag/2.9.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 1.5.0 until 2.9.0, the AttributesExtension's href and src unsafe-link filter can be bypassed by embedding control bytes, such as a tab, carriage return, line feed, or leading C0 control character, in a javascript: URL that browsers discard before parsing the scheme, causing the browser to still execute the script even when the unsafe-link filter is enabled. This issue is fixed in 2.9.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-86", "description": "CWE-86: Improper Neutralization of Invalid Characters in Identifiers in Web Pages"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-692", "description": "CWE-692: Incomplete Denylist to Cross-Site Scripting"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-06T20:30:32.045Z"}}}, "cveMetadata": {"cveId": "CVE-2026-71478", "state": "PUBLISHED", "dateUpdated": "2026-08-07T17:05:57.244Z", "dateReserved": "2026-08-06T19:56:23.724Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-06T20:30:32.045Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "commonmark", "vendor": "thephpleague", "versions": [{"status": "affected", "version": ">= 1.5.0, <= 2.8.3"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 1.5.0 until 2.9.0, the AttributesExtension's href and src unsafe-link filter can be bypassed by embedding control bytes, such as a tab, carriage return, line feed, or leading C0 control character, in a javascript: URL that browsers discard before parsing the scheme, causing the browser to still execute the script even when the unsafe-link filter is enabled. This issue is fixed in 2.9.0."}, {"lang": "es", "value": "league/commonmark es una biblioteca PHP para analizar y renderizar CommonMark Markdown. Desde 1.5.0 hasta 2.9.0, el filtro de enlaces no seguros href y src de AttributesExtension puede ser eludido incrustando bytes de control, como un tabulador, retorno de carro, salto de l\u00ednea o un car\u00e1cter de control C0 inicial, en una URL javascript_disabled: que los navegadores descartan antes de analizar el esquema, haciendo que el navegador siga ejecutando el script incluso cuando el filtro de enlaces no seguros est\u00e1 habilitado. Este problema est\u00e1 solucionado en 2.9.0."}], "id": "CVE-2026-71478", "lastModified": "2026-10-24T15:10:00.190", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71478", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-07T17:04:55.894840Z", "version": "2.0.3"}}]}, "published": "2026-08-06T22:18:31.750", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/thephpleague/commonmark/commit/493a5aa7d65754b73846006eaff9c2c4431a8e2c"}, {"source": "security-advisories@github.com", "url": "https://github.com/thephpleague/commonmark/releases/tag/2.9.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/thephpleague/commonmark/security/advisories/GHSA-29pj-957v-52mc"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/thephpleague/commonmark/security/advisories/GHSA-29pj-957v-52mc"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-86"}, {"lang": "en", "value": "CWE-692"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.5.0,2.8.3]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "commonmark", "source": "cna", "vendor": "thephpleague"}, "product": "commonmark", "vendor": "thephpleague"}], "created": "2026-08-07T01:00:05.869240+00:00", "updated": "2026-08-07T01:15:04.951129+00:00", "vendors": ["thephpleague", "thephpleague$PRODUCT$commonmark"]}