CyberRota Analysis
AI-GeneratedThe vulnerability affects the league/commonmark PHP library versions 1.5.0 to 2.9.0, specifically within the AttributesExtension's href and src unsafe-link filter, which can be bypassed by embedding control bytes in a javascript: URL. This flaw allows attackers to execute scripts in browsers even when the unsafe-link filter is active, potentially leading to cross-site scripting (XSS) attacks. Developers using affected versions should prioritize upgrading to version 2.9.0 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 1.5.0 until 2.9.0, the AttributesExtension's href and src unsafe-link filter can be bypassed by embedding control bytes, such as a tab, carriage return, line feed, or leading C0 control character, in a javascript: URL that browsers discard before parsing the scheme, causing the browser to still execute the script even when the unsafe-link filter is enabled. This issue is fixed in 2.9.0.