CVE-2025-46734

一、漏洞信息
 漏洞编号：[CVE-2025-46734](https://nvd.nist.gov/vuln/detail/CVE-2025-46734)
 漏洞归属组件：[python-commonmark](https://gitee.com/src-openeuler/python-commonmark)
 漏洞归属的版本：0.9.1
 CVSS V3.0分值：
  BaseScore：N/A None
  Vector：CVSS：3.0/
 漏洞简述：
  league/commonmark is a PHP Markdown parser. A cross-site scripting (XSS) vulnerability in the Attributes extension of the league/commonmark library (versions 1.5.0 through 2.6.x) allows remote attackers to insert malicious JavaScript calls into HTML. The league/commonmark library provides configuration options such as `html_input:  strip ` and `allow_unsafe_links: false` to mitigate cross-site scripting (XSS) attacks by stripping raw HTML and disallowing unsafe links. However, when the Attributes Extension is enabled, it introduces a way for users to inject arbitrary HTML attributes into elements via Markdown syntax using curly braces. Version 2.7.0 contains three changes to prevent this XSS attack vector: All attributes starting with `on` are considered unsafe and blocked by default; support for an explicit allowlist of allowed HTML attributes; and manually-added `href` and `src` attributes now respect the existing `allow_unsafe_links` configuration option. If upgrading is not feasible, please consider disabling the `AttributesExtension` for untrusted users and/or filtering the rendered HTML through a library like HTMLPurifier.
 漏洞公开时间：2025-05-06 04:15:21
 漏洞创建时间：2025-05-06 08:55:52
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2025-46734
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| security-advisories.github.com | https://github.com/thephpleague/commonmark/commit/f0d626cf05ad3e99e6db26ebcb9091b6cd1cd89b |  |
| security-advisories.github.com | https://github.com/thephpleague/commonmark/security/advisories/GHSA-3527-qv2q-pfvx |  |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://github.com/thephpleague/commonmark/commit/f0d626cf05ad3e99e6db26ebcb9091b6cd1cd89b |  | security-advisories.github.com |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
                            league/commonmark is a PHP Markdown parser. A cross-site scripting (XSS) vulnerability in the Attributes extension of the league/commonmark library (versions 1.5.0 through 2.6.x) allows remote attackers to insert malicious JavaScript calls into HTML. The league/commonmark library provides configuration options such as html_input: strip and allow_unsafe_links: false to mitigate cross-site scripting (XSS) attacks by stripping raw HTML and disallowing unsafe links. However, when the Attributes Extension is enabled, it introduces a way for users to inject arbitrary HTML attributes into elements via Markdown syntax using curly braces. Version 2.7.0 contains three changes to prevent this XSS attack vector: All attributes starting with on are considered unsafe and blocked by default; support for an explicit allowlist of allowed HTML attributes; and manually-added href and src attributes now respect the existing allow_unsafe_links configuration option. If upgrading is not feasible, please consider disabling the AttributesExtension for untrusted users and/or filtering the rendered HTML through a library like HTMLPurifier.             
 openEuler评分：
  6.4
 Vector：CVSS：3.0/
 受影响版本排查(受影响/不受影响)：
  1.master(0.9.1):不受影响
2.openEuler-20.03-LTS-SP4(0.9.1):不受影响
3.openEuler-22.03-LTS-SP3(0.9.1):不受影响
4.openEuler-22.03-LTS-SP4(0.9.1):不受影响
5.openEuler-24.03-LTS(0.9.1):不受影响
6.openEuler-24.03-LTS-Next(0.9.1):不受影响
7.openEuler-24.03-LTS-SP1(0.9.1):不受影响
8.openEuler-24.03-LTS-SP2(0.9.1):不受影响

修复是否涉及abi变化(是/否)：
  1.master(0.9.1):否
2.openEuler-20.03-LTS-SP4(0.9.1):否
3.openEuler-22.03-LTS-SP3(0.9.1):否
4.openEuler-22.03-LTS-SP4(0.9.1):否
5.openEuler-24.03-LTS(0.9.1):否
6.openEuler-24.03-LTS-Next(0.9.1):否
7.openEuler-24.03-LTS-SP1(0.9.1):否
8.openEuler-24.03-LTS-SP2(0.9.1):否
9.master(0.9.1):
10.openEuler-20.03-LTS-SP4(0.9.1):
11.openEuler-22.03-LTS-SP3(0.9.1):
12.openEuler-22.03-LTS-SP4(0.9.1):
13.openEuler-24.03-LTS(0.9.1):
14.openEuler-24.03-LTS-Next(0.9.1):
15.openEuler-24.03-LTS-SP1(0.9.1):
16.openEuler-24.03-LTS-SP2(0.9.1):
17.master(0.9.1):
18.openEuler-20.03-LTS-SP4(0.9.1):
19.openEuler-22.03-LTS-SP3(0.9.1):
20.openEuler-22.03-LTS-SP4(0.9.1):
21.openEuler-24.03-LTS(0.9.1):
22.openEuler-24.03-LTS-Next(0.9.1):
23.openEuler-24.03-LTS-SP1(0.9.1):
24.openEuler-24.03-LTS-SP2(0.9.1):
25.master(0.9.1):
26.openEuler-20.03-LTS-SP4(0.9.1):
27.openEuler-22.03-LTS-SP3(0.9.1):
28.openEuler-22.03-LTS-SP4(0.9.1):
29.openEuler-24.03-LTS(0.9.1):
30.openEuler-24.03-LTS-Next(0.9.1):
31.openEuler-24.03-LTS-SP1(0.9.1):
32.openEuler-24.03-LTS-SP2(0.9.1):
33.master(0.9.1):
34.openEuler-20.03-LTS-SP4(0.9.1):
35.openEuler-22.03-LTS-SP3(0.9.1):
36.openEuler-22.03-LTS-SP4(0.9.1):
37.openEuler-24.03-LTS(0.9.1):
38.openEuler-24.03-LTS-Next(0.9.1):
39.openEuler-24.03-LTS-SP1(0.9.1):
40.openEuler-24.03-LTS-SP2(0.9.1):
41.master(0.9.1):
42.openEuler-20.03-LTS-SP4(0.9.1):
43.openEuler-22.03-LTS-SP3(0.9.1):
44.openEuler-22.03-LTS-SP4(0.9.1):
45.openEuler-24.03-LTS(0.9.1):
46.openEuler-24.03-LTS-Next(0.9.1):
47.openEuler-24.03-LTS-SP1(0.9.1):
48.openEuler-24.03-LTS-SP2(0.9.1):
49.master(0.9.1):
50.openEuler-20.03-LTS-SP4(0.9.1):
51.openEuler-22.03-LTS-SP3(0.9.1):
52.openEuler-22.03-LTS-SP4(0.9.1):
53.openEuler-24.03-LTS(0.9.1):
54.openEuler-24.03-LTS-Next(0.9.1):
55.openEuler-24.03-LTS-SP1(0.9.1):
56.openEuler-24.03-LTS-SP2(0.9.1):
57.master(0.9.1):
58.openEuler-20.03-LTS-SP4(0.9.1):
59.openEuler-22.03-LTS-SP3(0.9.1):
60.openEuler-22.03-LTS-SP4(0.9.1):
61.openEuler-24.03-LTS(0.9.1):
62.openEuler-24.03-LTS-Next(0.9.1):
63.openEuler-24.03-LTS-SP1(0.9.1):
64.openEuler-24.03-LTS-SP2(0.9.1):
65.master(0.9.1):
66.openEuler-20.03-LTS-SP4(0.9.1):
67.openEuler-22.03-LTS-SP3(0.9.1):
68.openEuler-22.03-LTS-SP4(0.9.1):
69.openEuler-24.03-LTS(0.9.1):
70.openEuler-24.03-LTS-Next(0.9.1):
71.openEuler-24.03-LTS-SP1(0.9.1):
72.openEuler-24.03-LTS-SP2(0.9.1):
73.master(0.9.1):
74.openEuler-20.03-LTS-SP4(0.9.1):
75.openEuler-22.03-LTS-SP3(0.9.1):
76.openEuler-22.03-LTS-SP4(0.9.1):
77.openEuler-24.03-LTS(0.9.1):
78.openEuler-24.03-LTS-Next(0.9.1):
79.openEuler-24.03-LTS-SP1(0.9.1):
80.openEuler-24.03-LTS-SP2(0.9.1):
81.master(0.9.1):
82.openEuler-20.03-LTS-SP4(0.9.1):
83.openEuler-22.03-LTS-SP3(0.9.1):
84.openEuler-22.03-LTS-SP4(0.9.1):
85.openEuler-24.03-LTS(0.9.1):
86.openEuler-24.03-LTS-Next(0.9.1):
87.openEuler-24.03-LTS-SP1(0.9.1):
88.openEuler-24.03-LTS-SP2(0.9.1):
89.master(0.9.1):
90.openEuler-20.03-LTS-SP4(0.9.1):
91.openEuler-22.03-LTS-SP3(0.9.1):
92.ma

原因说明：
  1.master(0.9.1):
2.openEuler-20.03-LTS-SP4(0.9.1):
3.openEuler-22.03-LTS-SP3(0.9.1):
4.openEuler-22.03-LTS-SP4(0.9.1):
5.openEuler-24.03-LTS(0.9.1):
6.openEuler-24.03-LTS-Next(0.9.1):
7.openEuler-24.03-LTS-SP1(0.9.1):
8.openEuler-24.03-LTS-SP2(0.9.1):

src-openEuler/python-commonmark
关闭

内容风险标识

评论 (7)

src-openEuler/python-commonmark关闭 .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2025-46734

评论 (7)

搜索帮助

src-openEuler/python-commonmark
关闭