{"vulnerability": "ghsa-f8fg-pg57-v4j8", "sightings": [{"uuid": "066cc159-5a6b-4a0d-abb4-6dc36812fd88", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-F8FG-PG57-V4J8", "type": "seen", "source": "https://gist.github.com/alon710/e6c2d9d276bdf47f7083b04607dabf57", "content": "# GHSA-F8FG-PG57-V4J8: GHSA-f8fg-pg57-v4j8: Sanitizer Filter Bypass via Control Character Injection in league/commonmark\n\n> **CVSS Score:** 5.8\n> **Published:** 2026-09-01\n> **Full Report:** https://cvereports.com/reports/GHSA-F8FG-PG57-V4J8\n\n## Summary\nAn inconsistency in whitespace handling between the PCRE regex engine, PHP's native trim function, and web browsers allows unauthenticated attackers to bypass XSS protections in the league/commonmark AttributesExtension by injecting a Form Feed (U+000C) control character.\n\n## TL;DR\nA validation mismatch between PHP's regex matching and native trimming permits the Form Feed character (\\x0C) to survive attribute parsing. Browsers treat this character as whitespace, translating bypassed attributes into executable javascript handlers.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-79\n- **Attack Vector**: Network\n- **CVSS v3.1**: 5.8\n- **Exploit Status**: poc\n- **EPSS Score**: 0.01\n- **Impact**: Stored / Reflected Cross-Site Scripting (XSS)\n\n## Affected Systems\n\n- league/commonmark\n- **league/commonmark**: >= 2.7.0, < 2.9.1 (Fixed in: `2.9.1`)\n\n## Mitigation\n\n- Upgrade league/commonmark package to version 2.9.1 or higher.\n- Define strict attribute whitelists inside Environment configurations to discard unmapped attributes.\n- Sanitize or escape non-printable ASCII characters in input strings prior to Markdown compilation.\n\n**Remediation Steps:**\n1. Run the package update command: 'composer update league/commonmark'.\n2. Configure the 'attributes.allow' option in CommonMark settings to specify safe attribute domains.\n3. Audit application input handlers to detect input containing the \\x0C Form Feed control character.\n\n## References\n\n- [GitHub Security Advisory: GHSA-f8fg-pg57-v4j8](https://github.com/thephpleague/commonmark/security/advisories/GHSA-f8fg-pg57-v4j8)\n- [Official Fix Commit](https://github.com/thephpleague/commonmark/commit/dfcdf4554c16aa37c15e3a5ee3243ee26147c239)\n- [Package Repository](https://github.com/thephpleague/commonmark)\n- [Release Announcement 2.9.1](https://github.com/thephpleague/commonmark/releases/tag/2.9.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-F8FG-PG57-V4J8) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-02T11:43:47.094517Z"}]}