league/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a U+000C form feed

### Summary The `AttributesExtension` documents a security guarantee: > **Note:** Attributes starting with `on` (e.g.

历史摘要 · 未重新核验 · GitHub Advisory

league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 1.5.0 until 2.9.0, the AttributesExtension's href and src unsafe-link filter can be bypass...

CVE-2026-71478

league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 1.5.0 until 2.9.0, the Attributes

历史摘要 · 未重新核验 · NVD

league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes

CVE-2026-71478

## Summary The `AttributesExtension`'s `href`/`src` unsafe-link filter (`AttributesHelper::filterAttributes()`) can be

历史摘要 · 未重新核验 · GitHub Advisory

league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes

CVE-2026-71478

league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 1.5.0 until 2.9.0, the Attributes

历史摘要 · 未重新核验 · OSV.dev