[MEDIUM] league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes

PKSA-scnn-p8mm-jbft CVE-2026-71478 GHSA-29pj-957v-52mc

Affected package: league/commonmark

Affected version: >=1.5.0,<=2.8.3

Reported by:
GitHub