AUGUST 16, 2026
Live Feed
Back to database
Case File

CVE-2026-71478

MEDIUM · CVSS 6.1 EPSS 0.20% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-08-06 · Last synced 2026-08-16

CyberRota Analysis

AI-Generated

The vulnerability affects the league/commonmark PHP library versions 1.5.0 to 2.9.0, specifically within the AttributesExtension's href and src unsafe-link filter, which can be bypassed by embedding control bytes in a javascript: URL. This flaw allows attackers to execute scripts in browsers even when the unsafe-link filter is active, potentially leading to cross-site scripting (XSS) attacks. Developers using affected versions should prioritize upgrading to version 2.9.0 or later to mitigate this risk.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-71478
Severity
MEDIUM
CVSS
6.1
EPSS
0.20%
Java

Original NVD Description

league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 1.5.0 until 2.9.0, the AttributesExtension's href and src unsafe-link filter can be bypassed by embedding control bytes, such as a tab, carriage return, line feed, or leading C0 control character, in a javascript: URL that browsers discard before parsing the scheme, causing the browser to still execute the script even when the unsafe-link filter is enabled. This issue is fixed in 2.9.0.