THREAT OPS › Threat News › [GHSA] GHSA-29pj-957v-52mc (medium) — league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes
[GHSA] GHSA-29pj-957v-52mc (medium) — league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes
GHSA-29pj-957v-52mc Severity: medium CVE: CVE-2026-71478
league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes
## Summary
The `AttributesExtension`'s `href`/`src` unsafe-link filter (`AttributesHelper::filterAttributes()`) can be bypassed by embedding control bytes in a `javascript:` URL that browsers discard before parsing the scheme. Two variant
MITRE ATT&CK techniques
- JavaScriptT1059.007
Indicators of compromise
- CVE-2026-71478cve
- CVE-2025-46734cve
- https://example.com){href=url
Original source: https://github.com/advisories/GHSA-29pj-957v-52mc