[HIGH] league/commonmark: Quadratic-time denial of service when parsing crafted Markdown

PKSA-t21r-vtr5-3mdz CVE-2026-71488 GHSA-2q4p-g7hv-5rgv

Affected package: league/commonmark

Affected version: >=0.6.0,<2.9.0

Reported by:
GitHub