league/commonmark (thephpleague/commonmark) versions 2.7.0 through 2.9.0 contain a cross-site scripting (XSS) vulnerability in the AttributesExtension. Attackers can prefix attribute names with a U+000C form feed byte to bypass the AttributesHelper::filterAttributes() event-handler filter, as PHP's trim() does not strip this character. This allows injection of event handlers like onclick into rendered HTML. The same bypass also defeats the allow_unsafe_links check, permitting javascript: URIs in href/src attributes even when the setting is disabled. Exploitation requires that untrusted Markdown is processed with the AttributesExtension enabled. The injected script executes when the rendered HTML is viewed by a victim's browser. The vulnerability has been fixed in version 2.9.1.
