CVE-2026-86431 commonmark before 2.9.1 XSS via AttributesExtension form feed bypass

league/commonmark thephpleague/commonmark versions = 2.7.0 and 2.9.1 contain a cross-site scripting vulnerability in the AttributesExtension. Prefixing an attribute name with a single U+000C form feed byte e.g. \x0Conclick="alert1" bypasses the AttributesHelper::filterAttributes 'on' event-handle...

WS-2026-0049

league/commonmark's AttributesExtension left a form feed U+000C inside attribute names because PHP's default trim charlist omits the byte that PCRE's \s matches. Browsers treat U+000C as whitespace between attributes, so a name written as onclick="..." reached the browser as a genuine onclick...