CVE-2025-46734: league/commonmark XSS Vulnerability

CVE-2025-46734 Overview

CVE-2025-46734 is a cross-site scripting (XSS) vulnerability [CWE-79] in the Attributes extension of the league/commonmark PHP Markdown parser. The flaw affects versions 1.5.0 through 2.6.x and allows remote attackers to inject malicious JavaScript into rendered HTML. The Attributes Extension permits users to add arbitrary HTML attributes to elements through Markdown curly-brace syntax. This mechanism bypasses the standard html_input: 'strip' and allow_unsafe_links: false safeguards, enabling event handler attributes such as onclick or onerror to reach the output. Version 2.7.0 introduces three mitigations: blocking attributes starting with on, supporting an explicit attribute allowlist, and applying allow_unsafe_links to manually-added href and src attributes.

Critical Impact
Authenticated users who submit Markdown content can inject executable JavaScript into pages rendered by applications using the AttributesExtension, leading to session theft, account takeover, or further client-side attacks.

Affected Products

league/commonmark versions 1.5.0 through 2.6.x
PHP applications enabling the AttributesExtension
Downstream frameworks and CMS platforms bundling vulnerable versions of league/commonmark

Discovery Timeline

2025-05-05 - CVE-2025-46734 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-46734

Vulnerability Analysis

The league/commonmark library provides hardening options that strip raw HTML and reject unsafe links. The AttributesExtension, however, parses Markdown syntax of the form {attr=value} and attaches the supplied attributes directly to the generated HTML node. The extension does not consult the allow_unsafe_links configuration and does not validate attribute names against a safe list. As a result, an attacker can supply attributes such as onclick, onerror, or onmouseover containing JavaScript payloads, or replace href and src with javascript: URIs. The injection occurs through the normal Markdown rendering pipeline, so any application accepting untrusted Markdown and rendering it as HTML is exposed.

Root Cause

The root cause is missing attribute-name and attribute-value validation inside the AttributesListener event handler. Prior to version 2.7.0, the listener accepted any user-supplied attribute and merged it into the node without filtering event-handler prefixes or unsafe URI schemes. The configuration plumbing for allow_unsafe_links did not propagate to attribute parsing.

Attack Vector

The vulnerability is exploitable over the network by any actor able to submit Markdown content to an application using the vulnerable extension. Comment systems, wikis, ticketing platforms, and documentation portals are typical targets. Exploitation requires the victim to view the rendered output in a browser. The patch refactors the extension to implement ConfigurableExtensionInterface and passes the allowlist and allow_unsafe_links setting into the listener constructor.

php

// Patched AttributesExtension registration (league/commonmark 2.7.0)
final class AttributesExtension implements ConfigurableExtensionInterface
{
    public function configureSchema(ConfigurationBuilderInterface $builder): void
    {
        $builder->addSchema('attributes', Expect::structure([
            'allow' => Expect::arrayOf('string')->default([]),
        ]));
    }

    public function register(EnvironmentBuilderInterface $environment): void
    {
        $allowList        = $environment->getConfiguration()->get('attributes.allow');
        $allowUnsafeLinks = $environment->getConfiguration()->get('allow_unsafe_links');

        $environment->addBlockStartParser(new AttributesBlockStartParser());
        $environment->addInlineParser(new AttributesInlineParser());
        $environment->addEventListener(
            DocumentParsedEvent::class,
            [new AttributesListener($allowList, $allowUnsafeLinks), 'processDocument']
        );
    }
}
// Source: https://github.com/thephpleague/commonmark/commit/f0d626cf05ad3e99e6db26ebcb9091b6cd1cd89b

Detection Methods for CVE-2025-46734

Indicators of Compromise

Markdown submissions containing curly-brace attribute syntax with on* event handlers, for example {onclick="..."} or {onerror="..."}.
Rendered HTML pages containing inline event handlers or javascript: URIs originating from user-generated Markdown content.
Web server logs showing POST requests to comment, post, or content-creation endpoints with payloads containing {on substrings.

Detection Strategies

Inventory PHP applications and Composer lockfiles to identify projects pinned to league/commonmark versions between 1.5.0 and 2.6.x with the AttributesExtension enabled.
Apply web application firewall rules to flag Markdown input containing curly-brace blocks paired with on[a-z]+= patterns or javascript: schemes.
Review rendered HTML output in caches or static site outputs for unexpected event-handler attributes attached to user-generated nodes.

Monitoring Recommendations

Alert on Composer or dependency-scanner findings that surface league/commonmark < 2.7.0 in production builds.
Monitor Content Security Policy (CSP) violation reports for inline script execution on pages that render Markdown.
Track outbound network connections from user browsers to unexpected hosts shortly after viewing Markdown-rendered content.

How to Mitigate CVE-2025-46734

Immediate Actions Required

Upgrade league/commonmark to version 2.7.0 or later via composer update league/commonmark.
If upgrade is blocked, disable the AttributesExtension for any environment processing untrusted Markdown.
Pass rendered HTML through a sanitizer such as HTMLPurifier before delivering it to browsers.
Enforce a strict Content Security Policy that blocks inline event handlers and javascript: URIs.

Patch Information

The fix is delivered in league/commonmark2.7.0. See the GitHub Security Advisory GHSA-3527-qv2q-pfvx and the upstream commit for the technical changes. Post-patch, attributes starting with on are blocked by default, an explicit allowlist is supported through the attributes.allow configuration key, and href and src honor allow_unsafe_links.

Workarounds

Remove the AttributesExtension from the CommonMark environment when handling content from untrusted users.
Filter rendered output with HTMLPurifier or an equivalent allowlist-based HTML sanitizer.
Pre-process Markdown input to strip {...} attribute blocks before parsing.

bash

# Upgrade to the patched release
composer require league/commonmark:^2.7.0

# Verify the installed version
composer show league/commonmark | grep versions