Skip to content
Threat Feed
Subscribe

CPE

Cpe:2.3:a:thephpleague:commonmark:*:*:*:*:*:*:*:*

1 brief RSS
high advisory

Stored XSS via Attribute Filter Bypass in league/commonmark

An XSS vulnerability in league/commonmark allows attackers to execute arbitrary JavaScript by prepending a U+000C form feed character to malicious attribute names, bypassing security filters in the AttributesExtension.

commonmark +1 xss web-vulnerability php supply-chain denial-of-service algorithmic-complexity
3t 1c updated