CVE-2026-71478: 
PHP vulnerability analysis and mitigation

CVE-2026-71478 is a Cross-Site Scripting (XSS) vulnerability in league/commonmark, a PHP library for parsing and rendering CommonMark Markdown. The vulnerability affects versions >= 1.5.0 and <= 2.8.3, and allows attackers to bypass the AttributesExtension's href/src unsafe-link filter by embedding control bytes (tab, carriage return, line feed, or leading C0 control characters) in javascript: URLs. Browsers discard these control bytes before parsing the URL scheme, causing them to execute the JavaScript even when allow_unsafe_links => false is configured. The vulnerability was reported by TungNGo02, published to the GitHub Advisory Database on August 6, 2026, and carries a CVSS v3.1 base score of 6.1 (Medium) (Github Advisory, Security Advisory).

The root cause lies in RegexHelper::isLinkPotentiallyUnsafe() in src/Util/RegexHelper.php, which uses an anchored-prefix regex (/^(?:javascript|vbscript|file|data):/i) to detect dangerous URL schemes without first normalizing the input string. Two bypass variants exist: (1) embedding ASCII TAB (0x09), CR (0x0D), or LF (0x0A) within the scheme (e.g., java\tscript:alert(1)), which browsers strip per WHATWG URL Standard step 3; and (2) prepending a leading C0 control character (e.g., \x01javascript:alert(1)), which browsers strip per step 1 of the same algorithm. The AttributesExtension's attribute-value grammar (PARTIAL_DOUBLEQUOTEDVALUE = '"[^"]*"') accepts any byte except " inside quotes, including raw control bytes, and parseAttributes() only trims the default PHP charlist — so a leading \x01 survives into the safety check. Unlike the core Markdown link-destination path (which percent-encodes control bytes before the safety check), the Attributes extension's href/src handling has no equivalent normalization step. The vulnerability is classified as CWE-79 (XSS), CWE-86 (Improper Neutralization of Invalid Characters in Identifiers), and CWE-692 (Incomplete Denylist to XSS) (Security Advisory, Github Advisory).

Successful exploitation enables stored or reflected XSS in applications that render user-supplied Markdown with the AttributesExtension enabled. An attacker can steal session cookies, perform account takeover, execute arbitrary JavaScript in a victim's browser session, and potentially pivot to further attacks within the application's security scope. The scope is marked as "Changed" in the CVSS scoring, reflecting that the impact extends beyond the vulnerable component to the victim's browser context. Availability is not directly impacted, but confidentiality and integrity are both affected at a low level per the CVSS assessment (Github Advisory).

No public exploit code or in-the-wild exploitation has been reported as of the advisory publication date. The EPSS score is 0.0, indicating very low current exploitation probability, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires no privileges and no special configuration beyond the commonly-used AttributesExtension being enabled, but does require user interaction (a victim must click the malicious link). The attack complexity is low, as the bypass technique is straightforward and well-documented in the advisory (Github Advisory, Security Advisory).

1. Identify a target application: Find a web application that uses league/commonmark versions >= 1.5.0 and <= 2.8.3 with the AttributesExtension enabled and allow_unsafe_links => false configured, and that renders user-supplied Markdown.
2. Craft the malicious Markdown payload: Construct a Markdown link that uses an unsafe core destination (to prevent LinkRenderer from overwriting the attribute-supplied href) combined with an obfuscated javascript: URL in the attribute block. Example using a literal TAB (0x09) byte:

   [Click me](javascript:alert(0)){href="java\tscript:alert(document.cookie)"}

3. Submit the payload: Post the crafted Markdown to a location where it will be rendered and viewed by other users (e.g., a comment field, wiki page, or user profile).
4. Trigger victim execution: When a victim views the rendered page and clicks the link, the browser strips the embedded TAB character from the href value, resolves javascript:alert(document.cookie), and executes the script in the victim's session.
5. Harvest results: The executed script can exfiltrate session cookies, perform actions on behalf of the victim, or deliver further payloads to the attacker-controlled server (Security Advisory, Github Advisory).

• Network: Outbound HTTP requests from victim browsers to attacker-controlled domains immediately after interacting with Markdown-rendered content; requests carrying stolen cookie values in query parameters or POST bodies.
• Logs: Web server or application logs showing Markdown submissions containing control characters (0x09, 0x0D, 0x0A, 0x01–0x1F) embedded within href or src attribute values in {...} attribute blocks; patterns like java\tscript:, java\nscript:, java\rscript:, or \x01javascript: in stored content.
• File System: Stored Markdown content in databases or files containing raw control bytes within link attribute syntax (e.g., {href="java[TAB]script:..."}); these may appear as unusual whitespace or non-printable characters in content fields.
• Application: Unexpected JavaScript execution reports from users; session hijacking events or anomalous authenticated actions following interaction with Markdown-rendered pages (Security Advisory).

The fix is available in league/commonmark version 2.9.0, released August 3, 2026. The patch normalizes the URL in RegexHelper::isLinkPotentiallyUnsafe() by stripping ASCII tab/newline characters and left-trimming C0 control characters before applying the unsafe-protocol regex, mirroring the WHATWG URL parser's own normalization. Upgrade via Composer: composer require league/commonmark:^2.9.0. No configuration-based workaround exists for affected versions — even the documented hardening setting (allow_unsafe_links => false) is bypassed by this vulnerability. Applications that cannot upgrade immediately should consider disabling the AttributesExtension entirely or sanitizing user-supplied Markdown with an additional HTML sanitizer before rendering (Security Advisory, Release 2.9.0, Patch Commit).

The vulnerability was responsibly disclosed by researcher TungNGo02 and acknowledged by maintainer Colin O'Dell (colinodell), who released the fix in version 2.9.0. The advisory notes this is a sibling gap to CVE-2025-46734 (GHSA-3527-qv2q-pfvx), which was fixed in v2.7.0 but did not address control-byte normalization. The 2.9.0 release also addressed five denial-of-service vulnerabilities, with special thanks given to GrahamCampbell and TungNGo02 for responsible disclosure (Release 2.9.0, Security Advisory).