CVE-2025-46734

一、漏洞信息
 漏洞编号：[CVE-2025-46734](https://nvd.nist.gov/vuln/detail/CVE-2025-46734)
 漏洞归属组件：[python-commonmark](https://gitee.com/src-openeuler/python-commonmark)
 漏洞归属的版本：0.9.1
 CVSS V3.0分值：
  BaseScore：N/A None
  Vector：CVSS：3.0/
 漏洞简述：
  league/commonmark is a PHP Markdown parser. A cross-site scripting (XSS) vulnerability in the Attributes extension of the league/commonmark library (versions 1.5.0 through 2.6.x) allows remote attackers to insert malicious JavaScript calls into HTML. The league/commonmark library provides configuration options such as `html_input:  strip ` and `allow_unsafe_links: false` to mitigate cross-site scripting (XSS) attacks by stripping raw HTML and disallowing unsafe links. However, when the Attributes Extension is enabled, it introduces a way for users to inject arbitrary HTML attributes into elements via Markdown syntax using curly braces. Version 2.7.0 contains three changes to prevent this XSS attack vector: All attributes starting with `on` are considered unsafe and blocked by default; support for an explicit allowlist of allowed HTML attributes; and manually-added `href` and `src` attributes now respect the existing `allow_unsafe_links` configuration option. If upgrading is not feasible, please consider disabling the `AttributesExtension` for untrusted users and/or filtering the rendered HTML through a library like HTMLPurifier.
 漏洞公开时间：2025-05-06 04:15:21
 漏洞创建时间：2025-05-06 08:55:52
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2025-46734
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| security-advisories.github.com | https://github.com/thephpleague/commonmark/commit/f0d626cf05ad3e99e6db26ebcb9091b6cd1cd89b |  |
| security-advisories.github.com | https://github.com/thephpleague/commonmark/security/advisories/GHSA-3527-qv2q-pfvx |  |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://github.com/thephpleague/commonmark/commit/f0d626cf05ad3e99e6db26ebcb9091b6cd1cd89b |  | security-advisories.github.com |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  league/commonmark is a PHP Markdown parser. A cross-site scripting (XSS) vulnerability in the Attributes extension of the league/commonmark library (versions 1.5.0 through 2.6.x) allows remote attackers to insert malicious JavaScript calls into HTML. The league/commonmark library provides configuration options such as html_input: strip and allow_unsafe_links: false to mitigate cross-site scripting (XSS) attacks by stripping raw HTML and disallowing unsafe links. However, when the Attributes Extension is enabled, it introduces a way for users to inject arbitrary HTML attributes into elements via Markdown syntax using curly braces. Version 2.7.0 contains three changes to prevent this XSS attack vector: All attributes starting with on are considered unsafe and blocked by default; support for an explicit allowlist of allowed HTML attributes; and manually-added href and src attributes now respect the existing allow_unsafe_links configuration option. If upgrading is not feasible, please consider disabling the AttributesExtension for untrusted users and/or filtering the rendered HTML through a library like HTMLPurifier.
 openEuler评分：
  6.4
 Vector：CVSS：3.0/
 受影响版本排查(受影响/不受影响)：
  1.master(0.9.1):不受影响
2.openEuler-20.03-LTS-SP4(0.9.1):不受影响
3.openEuler-22.03-LTS-SP3(0.9.1):不受影响
4.openEuler-22.03-LTS-SP4(0.9.1):不受影响
5.openEuler-24.03-LTS(0.9.1):不受影响
6.openEuler-24.03-LTS-Next(0.9.1):不受影响
7.openEuler-24.03-LTS-SP1(0.9.1):不受影响
8.openEuler-24.03-LTS-SP2(0.9.1):不受影响

修复是否涉及abi变化(是/否)：
  1.master(0.9.1):否
2.openEuler-20.03-LTS-SP4(0.9.1):否
3.openEuler-22.03-LTS-SP3(0.9.1):否
4.openEuler-22.03-LTS-SP4(0.9.1):否
5.openEuler-24.03-LTS(0.9.1):否
6.openEuler-24.03-LTS-Next(0.9.1):否
7.openEuler-24.03-LTS-SP1(0.9.1):否
8.openEuler-24.03-LTS-SP2(0.9.1):否

原因说明：
  1.master(0.9.1):
2.openEuler-20.03-LTS-SP4(0.9.1):
3.openEuler-22.03-LTS-SP3(0.9.1):
4.openEuler-22.03-LTS-SP4(0.9.1):
5.openEuler-24.03-LTS(0.9.1):
6.openEuler-24.03-LTS-Next(0.9.1):
7.openEuler-24.03-LTS-SP1(0.9.1):
8.openEuler-24.03-LTS-SP2(0.9.1):

src-openEuler/python-commonmark

内容风险标识

评论 (7)

src-openEuler/python-commonmark .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2025-46734

评论 (7)

搜索帮助

src-openEuler/python-commonmark