Skip to content
Threat Feed
Subscribe

Product

Commonmark (>= 2.7.0, < 2.9.1)

1 brief RSS
high advisory

Stored XSS via Attribute Filter Bypass in league/commonmark

An XSS vulnerability in league/commonmark allows attackers to execute arbitrary JavaScript by prepending a U+000C form feed character to malicious attribute names, bypassing security filters in the AttributesExtension.

commonmark +1 xss web-vulnerability php supply-chain denial-of-service algorithmic-complexity
3t