league/commonmark contains a XSS vulnerability in Attributes extension
Summary
Cross-site scripting (XSS) vulnerability in the Attributes extension of the league/commonmark library (versions 1.5.0 through 2.6.x) allows remote attackers to insert malicious JavaScript calls into HTML.
Details
The league/commonmark library provides configuration options such as html_input: 'strip' and allow_unsafe_links: false to mitigate cross-site scripting (XSS) attacks by stripping raw HTML and disallowing unsafe links. However, when the Attributes Extension is enabled, it introduces a way for users to inject arbitrary HTML attributes into elements via Markdown syntax using curly braces.
As a result, even with the secure configuration shown above, an attacker can inject dangerous attributes into applications using this extension via a payload such as:
![](){onerror=alert(1)}Which results in the following HTML:
<p><img onerror="alert(1)" src="" alt="" /></p>Which causes the JS to execute immediately on page load.
Patches
Version 2.7.0 contains three changes to prevent this XSS attack vector:
- All attributes starting with
onare considered unsafe and blocked by default - Support for an explicit allowlist of allowed HTML attributes
- Manually-added
hrefandsrcattributes now respect the existingallow_unsafe_linksconfiguration option
Workarounds
If upgrading is not feasible, please consider:
- Disabling the
AttributesExtensionfor untrusted users - Filtering the rendered HTML through a library like HTMLPurifier
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | league/commonmark | >= 1.5.0, < 2.7.0 | 2.7.0 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N- Weakness (CWE)
CWE-79- Platform
- Composer
- Package
league/commonmark- Disclosed
- 05.05.2025
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-3527-qv2q-pfvx - CC BY 4.0
Vulnerability history: league/commonmark
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 18
- First → latest
- 09.2019 09.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 10
- Medium 8
Disclosures per year
- 2019: 1
- 2020: 0
- 2021: 0
- 2022: 1
- 2023: 0
- 2024: 1
- 2025: 1
- 2026: 14
-
league/commonmark contains a XSS vulnerability in Attributes extension this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.