CVE-2025-46734: League/commonmark Cross-Site Scripting Vulnerability
MODERATECVE-2025-46734 is a MODERATE (CVSS 6.4) cross-site scripting vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')) affecting League/commonmark libraries in the Packagist ecosystem. The issue involves league/commonmark contains a xss vulnerability in attributes extension. Remediation is available by upgrading affected packages to version 2.7.0.
CVE-2025-46734 at a Glance
Security Impact
CVSS: 6.4
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N).
How to Fix CVE-2025-46734
To remediate this vulnerability, upgrade all affected League/commonmark dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade league/commonmark to 2.7.0Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for league/commonmarkHow to Check if You Are Affected
To determine whether your application is affected by CVE-2025-46734, inspect your project dependencies for League/commonmark:
inspect dependencies for league/commonmarkAnalyze the terminal output to locate any version of League/commonmark in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2.7.0), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), where the product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. In League/commonmark, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2025-46734 Affected League/commonmark Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
league/commonmark
|
Packagist |
≥ 1.5.0
< 2.7.0
|
2.7.0
|
References
Frequently Asked Questions
What is CVE-2025-46734?
Which League/commonmark versions are affected?
What version fixes CVE-2025-46734?
Is league/commonmark affected?
What is the CVSS score of CVE-2025-46734?
What CWE is associated with CVE-2025-46734?
How can I check Packagist dependencies for CVE-2025-46734?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-3527-qv2q-pfvx",
"modified" : "2026-03-20T21:27:09Z",
"published" : "2025-05-05T20:40:36Z",
"aliases" : [ "CVE-2025-46734" ],
"summary" : "league/commonmark contains a XSS vulnerability in Attributes extension",
"details" : "### Summary\nCross-site scripting (XSS) vulnerability in the [Attributes extension](https://commonmark.thephpleague.com/extensions/attributes/) of the league/commonmark library (versions 1.5.0 through 2.6.x) allows remote attackers to insert malicious JavaScript calls into HTML.\n\n### Details\n\nThe league/commonmark library provides configuration options such as `html_input: 'strip'` and `allow_unsafe_links: false` to mitigate cross-site scripting (XSS) attacks by stripping raw HTML and disallowing unsafe links. However, when the Attributes Extension is enabled, it introduces a way for users to inject arbitrary HTML attributes into elements via Markdown syntax using curly braces.\n\nAs a result, even with the secure configuration shown above, an attacker can inject dangerous attributes into applications using this extension via a payload such as:\n\n```md\n![](){onerror=alert(1)}\n```\n\nWhich results in the following HTML:\n\n```html\n<p><img onerror=\"alert(1)\" src=\"\" alt=\"\" /></p>\n```\n\nWhich causes the JS to execute immediately on page load.\n\n### Patches\n\nVersion 2.7.0 contains three changes to prevent this XSS attack vector:\n\n- All attributes starting with `on` are considered unsafe and blocked by default\n- [Support for an explicit allowlist of allowed HTML attributes](https://commonmark.thephpleague.com/2.7/extensions/attributes/#configuration)\n- Manually-added `href` and `src` attributes now respect the existing `allow_unsafe_links` configuration option\n\n### Workarounds\n\nIf upgrading is not feasible, please consider:\n\n- Disabling the `AttributesExtension` for untrusted users\n- [Filtering the rendered HTML through a library like HTMLPurifier](https://commonmark.thephpleague.com/security/#additional-filtering)",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Packagist",
"name" : "league/commonmark"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "1.5.0"
}, {
"fixed" : "2.7.0"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/thephpleague/commonmark/security/advisories/GHSA-3527-qv2q-pfvx"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-46734"
}, {
"type" : "WEB",
"url" : "https://github.com/thephpleague/commonmark/commit/f0d626cf05ad3e99e6db26ebcb9091b6cd1cd89b"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/thephpleague/commonmark"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-79" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2025-05-05T20:40:36Z",
"nvd_published_at" : "2025-05-05T20:15:21Z"
}
}