CVE-2025-46734

league/commonmark is a PHP Markdown parser. A cross-site scripting (XSS) vulnerability in the Attributes extension of the league/commonmark library (versions 1.5.0 through 2.6.x) allows remote attackers to insert malicious JavaScript calls into HTML. The league/commonmark library provides configuration options such as `html_input: 'strip'` and `allow_unsafe_links: false` to mitigate cross-site scripting (XSS) attacks by stripping raw HTML and disallowing unsafe links. However, when the Attributes Extension is enabled, it introduces a way for users to inject arbitrary HTML attributes into elements via Markdown syntax using curly braces. Version 2.7.0 contains three changes to prevent this XSS attack vector: All attributes starting with `on` are considered unsafe and blocked by default; support for an explicit allowlist of allowed HTML attributes; and manually-added `href` and `src` attributes now respect the existing `allow_unsafe_links` configuration option. If upgrading is not feasible, please consider disabling the `AttributesExtension` for untrusted users and/or filtering the rendered HTML through a library like HTMLPurifier.

• CWE-79

• https://github.com/thephpleague/commonmark/commit/f0d626cf05ad3e99e6db26ebcb9091b6cd1cd89b
• https://github.com/thephpleague/commonmark/security/advisories/GHSA-3527-qv2q-pfvx

Published

May 5, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-46729julmud/phpDVDProfiler is an adoption of the defunct phpDVDPr…2.1
• CVE-2025-4673Proxy-Authorization and Proxy-Authenticate headers persisted…6.8
• CVE-2025-46730MobSF is a mobile application security testing tool used. Ty…6.5
• CVE-2025-46731Craft is a content management system. Versions of Craft CMS …7.2
• CVE-2025-46732OpenCTI is an open source platform for managing cyber threat…5.4
• CVE-2025-46733OP-TEE is a Trusted Execution Environment (TEE) designed as …7.9
• CVE-2025-46735Terraform WinDNS Provider allows users to manage their Windo…1.1
• CVE-2025-46736Umbraco is a free and open source .NET content management sy…5.3
• CVE-2025-46737SEL-5037 Grid Configurator contains an overly permissive Cro…7.4
• CVE-2025-46738An authenticated attacker can maliciously modify layout data…6.6
• CVE-2025-46739An unauthenticated user could discover account credentials v…8.1
• CVE-2025-4674The go command may execute unexpected commands when operatin…8.6