Cette page suit l'état du correctif pour Ubuntu. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2026-71478 →
UBUNTU-CVE-2026-71478
league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 1.5.0 until 2.9.0, the AttributesExtension's href and src unsaf...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 1.5.0 until 2.9.0, the AttributesExtension's href and src unsafe-link filter can be bypassed by embedding control bytes, such as a tab, carriage return, line feed, or leading C0 control character, in a javascript: URL that browsers discard before parsing the scheme, causing the browser to still execute the script even when the unsafe-link filter is enabled. This issue is fixed in 2.9.0.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Ubuntu:16.04:LTS
markdown
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:18.04:LTS
markdown
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:20.04:LTS
markdown
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:22.04:LTS
commonmark
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:22.04:LTS
markdown
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:24.04:LTS
commonmark
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:24.04:LTS
markdown
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:26.10
commonmark
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:26.10
markdown
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:26.04:LTS
commonmark
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:26.04:LTS
markdown
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Références
- report ubuntu.com
- report cve.org
- report github.com
- report github.com
- report github.com