CWE-86
CVEs classified under CWE-86, newest first.
2 CVEsRSS
GHSA-f8fg-pg57-v4j8High· 7.2league/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a U+000C form feed
league/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a U+000C form feed
▾ Twilightleague · league/commonmarkvia GHSA
CVE-2026-71478Medium· 6.1league/commonmark is a PHP library for parsing and rendering CommonMark Markdown
league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 1.5.0 until 2.9.0, the AttributesExtension's href and src unsafe-link filter can be bypassed by embedding control bytes, such as a tab, carriage retur…
▾ Sunlitleague · league/commonmarkEPSS 0.25%via NVD