WS-2026-0049

league/commonmark's AttributesExtension left a form feed U+000C inside attribute names because PHP's default trim charlist omits the byte that PCRE's \s matches. Browsers treat U+000C as whitespace between attributes, so a name written as onclick="..." reached the browser as a genuine onclick...