{"items":[{"id":"NVI-00005655","kind":"vulnerability","title":"league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes","revision":4,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-29pj-957v-52mc","CVE-2026-71478"],"plain_summary":"OSV carries this publisher advisory for league/commonmark. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 2.9.0 for league/commonmark. Confirm the publisher’s latest guidance.","source_ids":["sr-978f1ada7a3fd8ed3cddf7542617af5c"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-0836fa2eb6ab46e77ad44a861058bddc"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-24T15:10:00.190Z","value":"6.1 MEDIUM (3.1)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-30a1d9f7105a2ddc69e1ba12404d76f6"},{"kind":"EPSS","as_of":"2026-11-03T12:00:27.000Z","value":"0.355%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.29259. Missing scores are unknown.","source_id":"sr-0836fa2eb6ab46e77ad44a861058bddc"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-978f1ada7a3fd8ed3cddf7542617af5c","url":"https://github.com/advisories/GHSA-29pj-957v-52mc","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-29pj-957v-52mc","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:41:40.014Z"},{"id":"sr-30a1d9f7105a2ddc69e1ba12404d76f6","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71478","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-71478","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-01T07:24:49.802Z"},{"id":"sr-0836fa2eb6ab46e77ad44a861058bddc","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-71478","publisher":"FIRST EPSS","observed_at":"2026-11-03T17:45:16.078Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-978f1ada7a3fd8ed3cddf7542617af5c"],"technology":"league/commonmark","known_exclusions":[],"conditions_summary":"## Summary\n\nThe `AttributesExtension`'s `href`/`src` unsafe-link filter (`AttributesHelper::filterAttributes()`) can be bypassed by embedding control bytes in a `javascript:` URL that browsers discard before parsing the scheme. Two variants:\n\n- **Tab/newline inside the scheme** — a literal ASCII TAB (0x09), CR (0x0D), or LF (0x0A), e.g. `javascript:alert(1)`. Per the WHATWG URL Standard's \"basic URL parser\" step 3, browsers \"remove all ASCII tab or newline from input\".\n- **Leading C0 controls** — e.g. `javascript:alert(1)`. Per step 1 of the same algorithm, browsers remove any leading or trailing C0 control or space. (A leading *space* alone does not bypass, because `parseAttributes()` already `trim()`s the value; other C0 bytes are not trimmed.)\n\nThe filter is a literal anchored-prefix regex (`RegexHelper::isLinkPotentiallyUnsafe()` / `REGEX_UNSAFE_PROTOCOL`) that matches neither obfuscated form, so in both cases the browser still executes `javascript:alert(1)`.\n\n**This is confirmed reproducible even with `allow_unsafe_links => false` set** — i.e. even applications that have followed the library's own documented hardening guidance for untrusted input remain exploitable","public_affected_ranges":["ECOSYSTEM: introduced 1.5.0; fixed 2.9.0"]}],"null_published_at":"2026-11-04T10:04:41.558Z","source_updated_at":"2026-08-21T05:28:22.850Z","source_disclosed_at":"2026-08-06T20:30:39.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:41:40.014Z"},{"id":"NVI-00005655","kind":"vulnerability","title":"league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes","revision":3,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-29pj-957v-52mc","CVE-2026-71478"],"plain_summary":"OSV carries this publisher advisory for league/commonmark. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 2.9.0 for league/commonmark. Confirm the publisher’s latest guidance.","source_ids":["sr-978f1ada7a3fd8ed3cddf7542617af5c"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-2c9f67e711aefdadf008648d5af716bf"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-24T15:10:00.190Z","value":"6.1 MEDIUM (3.1)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-30a1d9f7105a2ddc69e1ba12404d76f6"},{"kind":"EPSS","as_of":"2026-10-31T12:00:27.000Z","value":"0.355%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.29224. Missing scores are unknown.","source_id":"sr-2c9f67e711aefdadf008648d5af716bf"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-978f1ada7a3fd8ed3cddf7542617af5c","url":"https://github.com/advisories/GHSA-29pj-957v-52mc","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-29pj-957v-52mc","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:41:40.014Z"},{"id":"sr-30a1d9f7105a2ddc69e1ba12404d76f6","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71478","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-71478","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-01T07:24:49.802Z"},{"id":"sr-2c9f67e711aefdadf008648d5af716bf","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-71478","publisher":"FIRST EPSS","observed_at":"2026-10-31T22:06:15.384Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-978f1ada7a3fd8ed3cddf7542617af5c"],"technology":"league/commonmark","known_exclusions":[],"conditions_summary":"## Summary\n\nThe `AttributesExtension`'s `href`/`src` unsafe-link filter (`AttributesHelper::filterAttributes()`) can be bypassed by embedding control bytes in a `javascript:` URL that browsers discard before parsing the scheme. Two variants:\n\n- **Tab/newline inside the scheme** — a literal ASCII TAB (0x09), CR (0x0D), or LF (0x0A), e.g. `javascript:alert(1)`. Per the WHATWG URL Standard's \"basic URL parser\" step 3, browsers \"remove all ASCII tab or newline from input\".\n- **Leading C0 controls** — e.g. `javascript:alert(1)`. Per step 1 of the same algorithm, browsers remove any leading or trailing C0 control or space. (A leading *space* alone does not bypass, because `parseAttributes()` already `trim()`s the value; other C0 bytes are not trimmed.)\n\nThe filter is a literal anchored-prefix regex (`RegexHelper::isLinkPotentiallyUnsafe()` / `REGEX_UNSAFE_PROTOCOL`) that matches neither obfuscated form, so in both cases the browser still executes `javascript:alert(1)`.\n\n**This is confirmed reproducible even with `allow_unsafe_links => false` set** — i.e. even applications that have followed the library's own documented hardening guidance for untrusted input remain exploitable","public_affected_ranges":["ECOSYSTEM: introduced 1.5.0; fixed 2.9.0"]}],"null_published_at":"2026-11-01T14:34:07.614Z","source_updated_at":"2026-08-21T05:28:22.850Z","source_disclosed_at":"2026-08-06T20:30:39.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-10-31T21:41:40.014Z"},{"id":"NVI-00005655","kind":"vulnerability","title":"league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-29pj-957v-52mc","CVE-2026-71478"],"plain_summary":"OSV carries this publisher advisory for league/commonmark. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 2.9.0 for league/commonmark. Confirm the publisher’s latest guidance.","source_ids":["sr-978f1ada7a3fd8ed3cddf7542617af5c"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-2c9f67e711aefdadf008648d5af716bf"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"EPSS","as_of":"2026-10-31T12:00:27.000Z","value":"0.355%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.29224. Missing scores are unknown.","source_id":"sr-2c9f67e711aefdadf008648d5af716bf"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-978f1ada7a3fd8ed3cddf7542617af5c","url":"https://github.com/advisories/GHSA-29pj-957v-52mc","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-29pj-957v-52mc","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:41:40.014Z"},{"id":"sr-2c9f67e711aefdadf008648d5af716bf","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-71478","publisher":"FIRST EPSS","observed_at":"2026-10-31T22:06:15.384Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-978f1ada7a3fd8ed3cddf7542617af5c"],"technology":"league/commonmark","known_exclusions":[],"conditions_summary":"## Summary\n\nThe `AttributesExtension`'s `href`/`src` unsafe-link filter (`AttributesHelper::filterAttributes()`) can be bypassed by embedding control bytes in a `javascript:` URL that browsers discard before parsing the scheme. Two variants:\n\n- **Tab/newline inside the scheme** — a literal ASCII TAB (0x09), CR (0x0D), or LF (0x0A), e.g. `javascript:alert(1)`. Per the WHATWG URL Standard's \"basic URL parser\" step 3, browsers \"remove all ASCII tab or newline from input\".\n- **Leading C0 controls** — e.g. `javascript:alert(1)`. Per step 1 of the same algorithm, browsers remove any leading or trailing C0 control or space. (A leading *space* alone does not bypass, because `parseAttributes()` already `trim()`s the value; other C0 bytes are not trimmed.)\n\nThe filter is a literal anchored-prefix regex (`RegexHelper::isLinkPotentiallyUnsafe()` / `REGEX_UNSAFE_PROTOCOL`) that matches neither obfuscated form, so in both cases the browser still executes `javascript:alert(1)`.\n\n**This is confirmed reproducible even with `allow_unsafe_links => false` set** — i.e. even applications that have followed the library's own documented hardening guidance for untrusted input remain exploitable","public_affected_ranges":["ECOSYSTEM: introduced 1.5.0; fixed 2.9.0"]}],"null_published_at":"2026-10-31T22:27:15.277Z","source_updated_at":"2026-08-21T05:28:22.850Z","source_disclosed_at":"2026-08-06T20:30:39.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:41:40.014Z"},{"id":"NVI-00005655","kind":"vulnerability","title":"league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-29pj-957v-52mc","CVE-2026-71478"],"plain_summary":"OSV carries this publisher advisory for league/commonmark. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 2.9.0 for league/commonmark. Confirm the publisher’s latest guidance.","source_ids":["sr-978f1ada7a3fd8ed3cddf7542617af5c"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-978f1ada7a3fd8ed3cddf7542617af5c","url":"https://github.com/advisories/GHSA-29pj-957v-52mc","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-29pj-957v-52mc","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:41:40.014Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-978f1ada7a3fd8ed3cddf7542617af5c"],"technology":"league/commonmark","known_exclusions":[],"conditions_summary":"## Summary\n\nThe `AttributesExtension`'s `href`/`src` unsafe-link filter (`AttributesHelper::filterAttributes()`) can be bypassed by embedding control bytes in a `javascript:` URL that browsers discard before parsing the scheme. Two variants:\n\n- **Tab/newline inside the scheme** — a literal ASCII TAB (0x09), CR (0x0D), or LF (0x0A), e.g. `javascript:alert(1)`. Per the WHATWG URL Standard's \"basic URL parser\" step 3, browsers \"remove all ASCII tab or newline from input\".\n- **Leading C0 controls** — e.g. `javascript:alert(1)`. Per step 1 of the same algorithm, browsers remove any leading or trailing C0 control or space. (A leading *space* alone does not bypass, because `parseAttributes()` already `trim()`s the value; other C0 bytes are not trimmed.)\n\nThe filter is a literal anchored-prefix regex (`RegexHelper::isLinkPotentiallyUnsafe()` / `REGEX_UNSAFE_PROTOCOL`) that matches neither obfuscated form, so in both cases the browser still executes `javascript:alert(1)`.\n\n**This is confirmed reproducible even with `allow_unsafe_links => false` set** — i.e. even applications that have followed the library's own documented hardening guidance for untrusted input remain exploitable","public_affected_ranges":["ECOSYSTEM: introduced 1.5.0; fixed 2.9.0"]}],"null_published_at":"2026-10-31T22:13:05.833Z","source_updated_at":"2026-08-21T05:28:22.850Z","source_disclosed_at":"2026-08-06T20:30:39.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:41:40.014Z"}],"next_cursor":null,"snapshot_revision":"42594"}