GHSA-29PJ-957V-52MC league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes

Summary The AttributesExtension's href/src unsafe-link filter AttributesHelper::filterAttributes can be bypassed by embedding control bytes in a javascript: URL that browsers discard before parsing the scheme. Two variants: - Tab/newline inside the scheme — a literal ASCII TAB 0x09, CR 0x0D, or...

CVE-2026-71478

league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 1.5.0 until 2.9.0, the AttributesExtension's href and src unsafe-link filter can be bypassed by embedding control bytes, such as a tab, carriage return, line feed, or leading C0 control character, in a...

CVE-2026-71478

Summary. league/commonmark 1.5.0–2.8.3 is vulnerable due to the AttributesExtension href/src unsafe-link filter bypass when control bytes are embedded in a javascript: URL. The browser may execute the script after the URL is parsed, even with allow_unsafe_links enabled. The issue is caused by ins...

CVE-2026-71478 league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes

league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 1.5.0 until 2.9.0, the AttributesExtension's href and src unsafe-link filter can be bypassed by embedding control bytes, such as a tab, carriage return, line feed, or leading C0 control character, in a...

CVE-2026-71478 league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes

league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 1.5.0 until 2.9.0, the AttributesExtension's href and src unsafe-link filter can be bypassed by embedding control bytes, such as a tab, carriage return, line feed, or leading C0 control character, in a...

EUVD-2026-54261

league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 1.5.0 until 2.9.0, the AttributesExtension's href and src unsafe-link filter can be bypassed by embedding control bytes, such as a tab, carriage return, line feed, or leading C0 control character, in a...

CVE-2026-71478 league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes

league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 1.5.0 until 2.9.0, the AttributesExtension's href and src unsafe-link filter can be bypassed by embedding control bytes, such as a tab, carriage return, line feed, or leading C0 control character, in a...

CVE-2026-71478

league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 1.5.0 until 2.9.0, the AttributesExtension's href and src unsafe-link filter can be bypassed by embedding control bytes, such as a tab, carriage return, line feed, or leading C0 control character, in a...

CVE-2026-71502 Unauthenticated Stored Vue Template Injection Leads to Cross-Site Scripting in CTI-Transmute

CTI-Transmute contains a stored cross-site scripting vulnerability caused by insufficient neutralization of Vue template expression delimiters in server-rendered user-controlled data. An unauthenticated attacker can create a public conversion whose name or description contains a malicious Vue...

Use of Blocking Code in Single-threaded, Non-blocking Context

Overview mermaid is a package for generation of diagrams and flowcharts from text in a similar manner as markdown. Affected versions of this package are vulnerable to Use of Blocking Code in Single-threaded, Non-blocking Context via the ticks parameter in radar diagrams. An attacker can cause...

Prototype Pollution

Overview mermaid is a package for generation of diagrams and flowcharts from text in a similar manner as markdown. Affected versions of this package are vulnerable to Prototype Pollution in the assignWithDepth process used by configuration APIs. An attacker can modify internal object properties b...

@142vip/vitepress (>=0.0.1-alpha.23, <=0.0.1-alpha.29), @142vip/vuepress (0.0.1-alpha.19) +211 more potentially affected by CVE-2026-50159 via mermaid (>=11.0.0, <=11.16.0)

mermaid NPM version =11.0.0, =0.0.1-alpha.23, =0.0.0, =2.1.0, =2.1.0, =0.1.0, =2.1.0, =2.1.0, =2.1.0, =2.0.2, =0.0.3, =0.15.0, =0.35.0, =0.2.0, =1.0.1 and more Source cves: CVE-2026-50159 Source advisory: OSV:GHSA-6X64-9X62-F2GX...

Improperly Controlled Sequential Memory Allocation

Overview org.webjars.npm:mermaid is a package for generation of diagrams and flowcharts from text in a similar manner as markdown. Affected versions of this package are vulnerable to Improperly Controlled Sequential Memory Allocation in the setXAxisRangeData function when configuring an X-Axis wi...

EUVD-2026-54241

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 10.6.0 until 10.9.8 and 11.16.1, Mermaid XY Charts are vulnerable to an infinite loop denial of service in the setXAxisRangeData function when configuring an X-Axis with invalid...

CVE-2026-71447 Stored Cross-Site Scripting in Chat and Forum Translation Controls in ail-framework

AIL Project contains a stored cross-site scripting vulnerability in the translation controls displayed for chat messages and forum posts. The affected templates inserted message and post identifiers directly into inline JavaScript onclick handlers: onclick="translateMessageToPreferredLanguage'...

CVE-2026-71447 Stored Cross-Site Scripting in Chat and Forum Translation Controls in ail-framework

AIL Project contains a stored cross-site scripting vulnerability in the translation controls displayed for chat messages and forum posts. The affected templates inserted message and post identifiers directly into inline JavaScript onclick handlers: onclick="translateMessageToPreferredLanguage'...

CVE-2026-71446 Stored Cross-Site Scripting in AIL Framework Domain Screenshot View

AIL Framework contains a stored cross-site scripting vulnerability in the crawler domain view. Crawled URLs were embedded directly into the JavaScript onclick handler used to display a stored screenshot, without context-appropriate encoding. An attacker who can cause a specially crafted URL to be...

CVE-2026-66843

Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows a remote attacker to load a document of their choosing into a trusted page via the data attribute of an element in sanitized HTML. object is the one URI-bearing element in...

CVE-2026-66683

Unauthenticated Sensitive Data Exposure in Custom CSS and JavaScript = 2.0.16 versions...

EUVD-2026-54082

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows a remote attacker to force visitors of a page to navigate to a site of the attacker's choosing via a element in sanitized HTML. HtmlSanitizeEx.html5/1 keeps attacker-supplied...