CVE-2025-46734 league/commonmark Cross-site Scripting vulnerability in Attributes extension
Remote attackers can inject malicious JavaScript via Markdown attributes in the league/commonmark library when the Attributes extension is enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-46734?
CVE-2025-46734 is a medium-severity cross-site scripting vulnerability in thephpleague commonmark, published on 5 May 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
league/commonmark is a PHP Markdown parser. A cross-site scripting (XSS) vulnerability in the Attributes extension of the league/commonmark library (versions 1.5.0 through 2.6.x) allows remote attackers to insert malicious JavaScript calls into HTML. The league/commonmark library provides configuration options such as `html_input: 'strip'` and `allow_unsafe_links: false` to mitigate cross-site scripting (XSS) attacks by stripping raw HTML and disallowing unsafe links. However, when the Attributes Extension is enabled, it introduces a way for users to inject arbitrary HTML attributes into elements via Markdown syntax using curly braces. Version 2.7.0 contains three changes to prevent this XSS attack vector: All attributes starting with `on` are considered unsafe and blocked by default; support for an explicit allowlist of allowed HTML attributes; and manually-added `href` and `src` attributes now respect the existing `allow_unsafe_links` configuration option. If upgrading is not feasible, please consider disabling the `AttributesExtension` for untrusted users and/or filtering the rendered HTML through a library like HTMLPurifier.
Weakness: CWE-79
Which versions are affected by CVE-2025-46734?
2 open source packages ship an affected version, including league/commonmark.
| Package | Affected | Fixed in |
|---|---|---|
league/commonmark Packagist | From 1.5.0 | 2.7.0 |
league/commonmark Packagist | From 1.5.0 | 2.7.0 |
How do I fix CVE-2025-46734?
Upgrade league/commonmark to 2.7.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-46734 being exploited?
There is no known exploitation of CVE-2025-46734 in the wild and no public exploit code.
Sources
Also known as CLSA-2026-1771980771, DEBIAN-CVE-2025-46734, GHSA-3527-qv2q-pfvx, UBUNTU-CVE-2025-46734.