PT-2026-86797

league/commonmark thephpleague/commonmark versions = 2.7.0 and 2.9.1 contain a cross-site scripting vulnerability in the AttributesExtension. Prefixing an attribute name with a single U+000C form feed byte e.g. x0Conclick="alert1" bypasses the AttributesHelper::filterAttributes 'on' event-handler...

Incomplete List of Disallowed Inputs

Overview Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs via improper handling of namespaced or prefixed script elements and case-sensitive matching of JavaScript URIs in the removeScripts plugin. An attacker can execute arbitrary scripts in the context of...