CVE-2025-54476: Joomla! CMS vulnerable to XSS via the input filter

The vulnerability lies in the checkAttribute method of the Joomla\Filter\InputFilter class. The provided patches clearly show that this function was modified to mitigate an XSS vulnerability. The core of the vulnerability is that the function failed to account for whitespace and other non-printable characters that could be used to obfuscate malicious JavaScript in HTML attributes. An attacker could craft an input like <img src="java\tscript:alert('xss')">, which would bypass the original filter. The patch adds a line of code to strip these characters from the attribute value before it is checked for dangerous content. This directly points to checkAttribute as the vulnerable function. The other modified files are test cases that confirm the fix by adding new tests for the previously successful XSS vectors.