[HIGH] league/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a U+000C form feed

PKSA-kr3s-894t-g5w2 GHSA-f8fg-pg57-v4j8

Affected package: league/commonmark

Affected version: >=2.7.0,<2.9.1

Reported by:
GitHub