{"action":"Upgrade league/commonmark to 2.9.1 or later.","affected":[{"fixed":"2.9.1","introduced":"2.7.0"}],"component":"league/commonmark","cve_ids":["CVE-2026-86431"],"ecosystem":"Packagist","epss":0.00388,"exploited":false,"fixed_versions":["2.9.1"],"ghsa_id":"GHSA-f8fg-pg57-v4j8","id":"tcs_01M5KF1KKY4ASETYMFE8231DT8","modified_at":"2026-09-08T12:38:28.846289731Z","published_at":"2026-09-01T20:18:29Z","references":["https://osv.dev/vulnerability/GHSA-f8fg-pg57-v4j8","https://github.com/thephpleague/commonmark/security/advisories/GHSA-f8fg-pg57-v4j8","https://github.com/thephpleague/commonmark/commit/dfcdf4554c16aa37c15e3a5ee3243ee26147c239","https://github.com/thephpleague/commonmark","https://github.com/thephpleague/commonmark/releases/tag/2.9.1"],"severity":{"label":"high","score":7.2},"sources":[{"source":"osv","source_id":"GHSA-f8fg-pg57-v4j8","url":"https://osv.dev/vulnerability/GHSA-f8fg-pg57-v4j8"}],"summary":"league/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a U+000C form feed"}