Common Weakness Enumeration
CWE-86 Improper Neutralization of Invalid Characters in Identifiers in Web Pages
Description
The product does not neutralize or incorrectly neutralizes invalid characters or byte sequences in the middle of tag names, URI schemes, and other identifiers.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-86 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-f8fg-pg57-v4j8 | - | HIGH | - |
league/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a U+000C form feed |
2026-09-01 |
| GHSA-29pj-957v-52mc | CVE-2026-71478 | MODERATE | - |
league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes |
2026-08-06 |
| GHSA-663w-2xp3-5739 | CVE-2023-37908 | CRITICAL |
org.xwiki.rendering:xwiki-rendering-xml Improper Neutralization of Invalid Characters in Identifiers in Web Pages vulnerability |
2023-11-01 | |
| GHSA-pv7v-ph6g-3gxv | CVE-2023-31126 | CRITICAL |
Improper Neutralization of Invalid Characters in Data Attribute Names in org.xwiki.commons:xwiki-commons-xml |
2023-05-09 |