GHSA-F8FG-PG57-V4J8: GHSA-f8fg-pg57-v4j8: Sanitizer Filter Bypass via Control Character Injection in league/commonmark

#security #cve #cybersecurity #ghsa

GHSA-f8fg-pg57-v4j8: Sanitizer Filter Bypass via Control Character Injection in league/commonmark

Vulnerability ID: GHSA-F8FG-PG57-V4J8
CVSS Score: 5.8
Published: 2026-09-01

An inconsistency in whitespace handling between the PCRE regex engine, PHP's native trim function, and web browsers allows unauthenticated attackers to bypass XSS protections in the league/commonmark AttributesExtension by injecting a Form Feed (U+000C) control character.

TL;DR

A validation mismatch between PHP's regex matching and native trimming permits the Form Feed character (\x0C) to survive attribute parsing. Browsers treat this character as whitespace, translating bypassed attributes into executable javascript handlers.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-79
Attack Vector: Network
CVSS v3.1: 5.8
Exploit Status: poc
EPSS Score: 0.01
Impact: Stored / Reflected Cross-Site Scripting (XSS)

Affected Systems

league/commonmark
league/commonmark: >= 2.7.0, < 2.9.1 (Fixed in: 2.9.1)

Code Analysis

Commit: dfcdf45

Fix vulnerability involving control characters bypassing attributes extension sanitization filter

Mitigation Strategies

Upgrade league/commonmark package to version 2.9.1 or higher.
Define strict attribute whitelists inside Environment configurations to discard unmapped attributes.
Sanitize or escape non-printable ASCII characters in input strings prior to Markdown compilation.

Remediation Steps:

Run the package update command: 'composer update league/commonmark'.
Configure the 'attributes.allow' option in CommonMark settings to specify safe attribute domains.
Audit application input handlers to detect input containing the \x0C Form Feed control character.

References

Read the full report for GHSA-F8FG-PG57-V4J8 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community