[MEDIUM] league/commonmark has an embed extension allowed_domains bypass

PKSA-21fb-n1x5-5nf7 CVE-2026-33347 GHSA-hh8v-hgvp-g3f5

Affected package: league/commonmark

Affected version: <=2.8.1

Reported by:
GitHub