GHSA-3527-qv2q-pfvx — medium GitHub Advisory (CVE-2025-46734) in composer/league/commonmark

Description

Summary

Cross-site scripting (XSS) vulnerability in the Attributes extension of the league/commonmark library (versions 1.5.0 through 2.6.x) allows remote attackers to insert malicious JavaScript calls into HTML.

Details

The league/commonmark library provides configuration options such as html_input: 'strip' and allow_unsafe_links: false to mitigate cross-site scripting (XSS) attacks by stripping raw HTML and disallowing unsafe links. However, when the Attributes Extension is enabled, it introduces a way for users to inject arbitrary HTML attributes into elements via Markdown syntax using curly braces.

As a result, even with the secure configuration shown above, an attacker can inject dangerous attributes into applications using this extension via a payload such as:

![](){onerror=alert(1)}

Which results in the following HTML:

&lt;p&gt;&lt;img onerror=&quot;alert(1)&quot; src=&quot;&quot; alt=&quot;&quot; /&gt;&lt;/p&gt;

Which causes the JS to execute immediately on page load.

Patches

Version 2.7.0 contains three changes to prevent this XSS attack vector:

All attributes starting with on are considered unsafe and blocked by default
Support for an explicit allowlist of allowed HTML attributes
Manually-added href and src attributes now respect the existing allow_unsafe_links configuration option

Workarounds

If upgrading is not feasible, please consider:

Disabling the AttributesExtension for untrusted users
Filtering the rendered HTML through a library like HTMLPurifier

Basic information

Type: reviewed
Severity: medium
Advisory on GitHub: Open advisory ↗
Repository advisory: Open repository advisory ↗
Source code: Browse source ↗
Published (advisory): 2025-05-05 20:40:36 UTC
Updated: 2026-05-28 10:01:30 UTC
GitHub reviewed: 2025-05-05 20:40:36 UTC
NVD published: 2025-05-05

Score	Percentile
0.05%	15.51%

CVSS Scores

Base score	Version	Severity	Vector
6.4	3.1	—	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N` Click to expand Attack vector (AV:N) Could be attacked over the internet or any normal routed network—not just someone sitting at the machine. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:L) A normal user session is enough; they don’t have to be admin. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:C) Breaking this can reach past the original component and bite other resources—bigger blast radius. Confidentiality (C:L) Some sensitive info could get out, but not a total data dump. Integrity (I:L) Attackers could change some data, but it’s limited—not everything goes. Availability (A:N) Service keeps running; no real outage angle.

Identifiers

Type	Value
GHSA	GHSA-3527-qv2q-pfvx ↗
CVE	CVE-2025-46734 ↗

CWEs

CWE id	Name
CWE-79	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Credits

TRIKKSS (finder)
bizibabe (finder)

Affected packages (1)

Vulnerable version ranges and first patched releases as published by GitHub.

Ecosystem	Package	Vulnerable range	First patched	Vulnerable functions
composer	league/commonmark	>= 1.5.0, < 2.7.0	2.7.0	—

league/commonmark contains a XSS vulnerability in Attributes extension