league/commonmark contains a XSS vulnerability in Attributes extension

What’s vulnerable

• League\CommonMark\Extension\Attributes\AttributesExtension

  Attribute syntax lets Markdown authors add event-handler attributes that survive html_input and allow_unsafe_links

You’re only affected if

All of these have to be true in your App. If one isn’t, the Advisory doesn’t affect you, even with the vulnerable version installed.

1. The App renders Markdown from untrusted input
2. The Attributes extension is added to the environment

How to check your App

Find every place the App builds a CommonMark converter or environment and check whether the Attributes extension is added, and whether the Markdown comes from users.

What the fix changed

2.7.0 blocks attributes that start with "on" by default, adds an explicit allowlist of HTML attributes, and makes hand-written href and src attributes respect allow_unsafe_links.

Upgrade to 2.7.0. Fix commit: f0d626c.

Review and corrections

Analysed 30 Oct 2026. Reviewed and approved by Craig Hewitt on 30 Oct 2026.

No corrections. When we correct a profile, the change and its date are listed here.

Sources

• GitHub Advisory Database: GHSA-3527-qv2q-pfvx
• OSV: GHSA-3527-qv2q-pfvx

Advisory metadata comes from the GitHub Advisory Database (CC-BY 4.0) and OSV. The analysis is ours. Profiles describe the conditions for being affected, never a working exploit.

More for Laravel Apps.