PT-2025-19795 · Unknown+3 · League/Commonmark+3

Trikkss · Published 2025-05-05 · Updated 2026-04-21 · CVE-2025-46734

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions league/commonmark versions 1.5.0 through 2.6.x

Description A cross-site scripting (XSS) vulnerability in the Attributes extension of the league/commonmark library allows remote attackers to insert malicious JavaScript calls into HTML. The library provides configuration options such as html input: 'strip' and allow unsafe links: false to mitigate XSS attacks. However, when the Attributes Extension is enabled, it introduces a way for users to inject arbitrary HTML attributes into elements via Markdown syntax using curly braces. This can result in the execution of malicious JavaScript code. For example, an attacker can inject dangerous attributes into applications using a payload such as ![](){onerror=alert(1)}, which results in the following HTML: <p><img onerror="alert(1)" src="" alt="" /></p>, causing the JavaScript to execute immediately on page load.

Recommendations For versions 1.5.0 through 2.6.x, consider disabling the AttributesExtension for untrusted users. For versions 1.5.0 through 2.6.x, consider filtering the rendered HTML through a library like HTMLPurifier. Update to version 2.7.0, which contains changes to prevent this XSS attack vector, including blocking attributes starting with on by default, supporting an explicit allowlist of allowed HTML attributes, and respecting the existing allow unsafe links configuration option for manually-added href and src attributes.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-46734

GHSA-3527-QV2Q-PFVX

USN-8194-1

Affected Products

Debian

Linuxmint

Ubuntu

League/Commonmark

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/46xxx/CVE-2025-46734.json · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-46734 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-46734 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-46734 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-46734 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33347 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-30838 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8194-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-46734 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-46734 · Security Note
• https://osv.dev/vulnerability/GHSA-3527-qv2q-pfvx · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-46734 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8194-1 · Vendor Advisory
• https://github.com/thephpleague/commonmark/security/advisories/GHSA-3527-qv2q-pfvx · Note
• https://github.com/thephpleague/commonmark/commit/f0d626cf05ad3e99e6db26ebcb9091b6cd1cd89b · Note