league/commonmark Security Advisories (18)
-
[MEDIUM] league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal
PKSA-m2dq-1fhr-29b1 GHSA-97jj-33gv-5xf9
Affected version: >=1.3.0,<=2.10.1
Reported by:
GitHub -
[HIGH] league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan
PKSA-m4t9-vsgq-8khn GHSA-3q6v-r5mr-hxv8
Affected version: >=2.0.0,<=2.10.1
Reported by:
GitHub -
[HIGH] league/commonmark: Denial of service via distinctly-named attributes in the Attributes extension
PKSA-zyf5-hrxv-hrd7 GHSA-8rr7-cvq3-gmfh
Affected version: >=1.5.0,<2.10.0
Reported by:
GitHub -
[HIGH] league/commonmark: Denial of service in the SmartPunct and Attributes extensions
PKSA-nv44-1b4d-6gjg GHSA-jjv6-8j6v-6j52
Affected version: >=1.5.0,<2.9.1
Reported by:
GitHub -
[HIGH] league/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a U+000C form feed
PKSA-kr3s-894t-g5w2 GHSA-f8fg-pg57-v4j8
Affected version: >=2.7.0,<2.9.1
Reported by:
GitHub -
[HIGH] league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters
PKSA-9q1p-3s19-bp1q GHSA-j8pm-gj4c-rq4x
Affected version: >=0.6.0,<2.9.1
Reported by:
GitHub -
[MEDIUM] league/commonmark: Denial of service via deeply nested XML output
PKSA-5mzr-szzf-z6cn GHSA-mj63-m3rc-8ppr
Affected version: >=2.0.0,<2.9.0
Reported by:
GitHub -
[HIGH] league/commonmark: Denial of service via colliding heading slugs
PKSA-cqd6-fg4n-nxpf GHSA-mh25-x5hq-wrqp
Affected version: >=2.0.0,<2.9.0
Reported by:
GitHub -
[HIGH] league/commonmark: Denial of service via duplicate footnote definitions
PKSA-1q6p-sqkj-8mmj GHSA-jfm3-95jq-q3rf
Affected version: >=1.5.0,<2.9.0
Reported by:
GitHub -
[HIGH] league/commonmark: Denial of service via adjacent inline attribute blocks
PKSA-mc58-w91n-f5gv GHSA-g2gp-3wwq-f4ph
Affected version: >=1.5.0,<2.9.0
Reported by:
GitHub -
[HIGH] league/commonmark: Quadratic-time denial of service when parsing crafted Markdown
PKSA-t21r-vtr5-3mdz CVE-2026-71488 GHSA-2q4p-g7hv-5rgv
Affected version: >=0.6.0,<2.9.0
Reported by:
GitHub -
[MEDIUM] league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes
PKSA-scnn-p8mm-jbft CVE-2026-71478 GHSA-29pj-957v-52mc
Affected version: >=1.5.0,<=2.8.3
Reported by:
GitHub -
[MEDIUM] league/commonmark has an embed extension allowed_domains bypass
PKSA-21fb-n1x5-5nf7 CVE-2026-33347 GHSA-hh8v-hgvp-g3f5
Affected version: >=2.3.0,<=2.8.1
Reported by:
GitHub -
[MEDIUM] CommonMark has DisallowedRawHtml extension bypass via whitespace in HTML tag names
PKSA-2cx9-ynrq-qdk3 CVE-2026-30838 GHSA-4v6x-c7xx-hw9f
Affected version: >=2.0.0,<=2.8.0
Reported by:
GitHub -
[MEDIUM] league/commonmark contains a XSS vulnerability in Attributes extension
PKSA-rqc2-tcc6-nc79 CVE-2025-46734 GHSA-3527-qv2q-pfvx
Affected version: >=1.5.0,<2.7.0
Reported by:
GitHub -
[HIGH] league/commonmark's quadratic complexity bugs may lead to a denial of service
PKSA-fndg-qryc-dyc9 GHSA-c2pc-g5qf-rfrf
Affected version: <2.6.0
Reported by:
GitHub -
[MEDIUM] XSS vulnerability with double-encoded entities
PKSA-nyyp-2pk1-frkz CVE-2019-10010 GHSA-3v43-877x-qgmq
Affected version: <0.18.3
Reported by:
GitHub, FriendsOfPHP/security-advisories -
[MEDIUM] XSS vulnerability with unsafe link protocols
PKSA-g6p7-7rfc-zbp2 CVE-2018-20583 GHSA-qx76-c53f-5c7q
Affected version: >=0.15.6,<0.18.1
Reported by:
GitHub, FriendsOfPHP/security-advisories