CVE-2026-71478

league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 1.5.0 until 2.9.0, the AttributesExtension's href and src unsafe-link filter can be bypassed by embedding control bytes, such as a tab, carriage return, line feed, or leading C0 control character, in a...

CVE-2026-71478

Summary. league/commonmark 1.5.0–2.8.3 is vulnerable due to the AttributesExtension href/src unsafe-link filter bypass when control bytes are embedded in a javascript: URL. The browser may execute the script after the URL is parsed, even with allow_unsafe_links enabled. The issue is caused by ins...

EUVD-2023-26633

Malicious code in bioql PyPI...

EUVD-2025-13411

Malicious code in bioql PyPI...

CVE-2025-46734

CVE-2025-46734 affects the PHP Markdown parser league/commonmark, specifically the Attributes extension (versions 1.5.0–2.6.x). The vulnerability allows injection of dangerous HTML attributes via Markdown syntax (e.g., curly braces) that can bypass HTML sanitization settings. Version 2.7.0 mitiga...