CVE-2026-71478

{
  "id": "CVE-2026-71478",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-06T22:18:31.750",
  "lastModified": "2026-10-24T15:10:00.190",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 1.5.0 until 2.9.0, the AttributesExtension's href and src unsafe-link filter can be bypassed by embedding control bytes, such as a tab, carriage return, line feed, or leading C0 control character, in a javascript: URL that browsers discard before parsing the scheme, causing the browser to still execute the script even when the unsafe-link filter is enabled. This issue is fixed in 2.9.0."
    },
    {
      "lang": "es",
      "value": "league/commonmark es una biblioteca PHP para analizar y renderizar CommonMark Markdown. Desde 1.5.0 hasta 2.9.0, el filtro de enlaces no seguros href y src de AttributesExtension puede ser eludido incrustando bytes de control, como un tabulador, retorno de carro, salto de línea o un carácter de control C0 inicial, en una URL javascript_disabled: que los navegadores descartan antes de analizar el esquema, haciendo que el navegador siga ejecutando el script incluso cuando el filtro de enlaces no seguros está habilitado. Este problema está solucionado en 2.9.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "thephpleague",
          "product": "commonmark",
          "versions": [
            {
              "version": ">= 1.5.0, <= 2.8.3",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-07T17:04:55.894840Z",
          "id": "CVE-2026-71478",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        },
        {
          "lang": "en",
          "value": "CWE-86"
        },
        {
          "lang": "en",
          "value": "CWE-692"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/thephpleague/commonmark/commit/493a5aa7d65754b73846006eaff9c2c4431a8e2c",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/thephpleague/commonmark/releases/tag/2.9.0",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/thephpleague/commonmark/security/advisories/GHSA-29pj-957v-52mc",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/thephpleague/commonmark/security/advisories/GHSA-29pj-957v-52mc",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}