MEDIUM6.1Packagist
GHSA-29pj-957v-52mc· CVE-2026-71478league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes
Modified: 8/21/2026
package
Packagist/league/commonmark
pkg:packagist/league/commonmark
HIGH7.5Packagist
GHSA-2q4p-g7hv-5rgv· CVE-2026-71488league/commonmark: Quadratic-time denial of service when parsing crafted Markdown
Modified: 8/21/2026
MEDIUM6.4Packagist
GHSA-3527-qv2q-pfvx· CVE-2025-46734league/commonmark contains a XSS vulnerability in Attributes extension
Modified: 3/20/2026
HIGH7.5Packagist
GHSA-3q6v-r5mr-hxv8· CVE-2026-105830league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan
Modified: 10/9/2026
MEDIUM6.1Packagist
GHSA-3v43-877x-qgmq· CVE-2019-10010Moderate severity vulnerability that affects league/commonmark
Modified: 2/16/2024
MEDIUM5.1Packagist
GHSA-4v6x-c7xx-hw9f· CVE-2026-30838CommonMark has DisallowedRawHtml extension bypass via whitespace in HTML tag names
Modified: 3/20/2026
HIGH7.5Packagist
GHSA-8rr7-cvq3-gmfh· CVE-2026-86428league/commonmark: Denial of service via distinctly-named attributes in the Attributes extension
Modified: 9/8/2026
MEDIUM6.1Packagist
GHSA-97jj-33gv-5xf9· CVE-2026-105829league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal
Modified: 10/9/2026
HIGH7.5Packagist
GHSA-c2pc-g5qf-rfrf· CVE-2024-58382league/commonmark's quadratic complexity bugs may lead to a denial of service
Modified: 9/10/2026
HIGH7.2Packagist
GHSA-f8fg-pg57-v4j8· CVE-2026-86431league/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a U+000C form feed
Modified: 9/8/2026
HIGH7.5Packagist
GHSA-g2gp-3wwq-f4phleague/commonmark: Denial of service via adjacent inline attribute blocks
Modified: 8/6/2026
MEDIUM6.3Packagist
GHSA-hh8v-hgvp-g3f5· CVE-2026-33347league/commonmark has an embed extension allowed_domains bypass
Modified: 3/27/2026
HIGH7.5Packagist
GHSA-j8pm-gj4c-rq4x· CVE-2026-86430league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters
Modified: 9/8/2026
HIGH7.5Packagist
GHSA-jfm3-95jq-q3rfleague/commonmark: Denial of service via duplicate footnote definitions
Modified: 8/6/2026
HIGH7.5Packagist
GHSA-jjv6-8j6v-6j52· CVE-2026-86429league/commonmark: Denial of service in the SmartPunct and Attributes extensions
Modified: 9/8/2026
HIGH7.5Packagist
GHSA-mh25-x5hq-wrqp· CVE-2026-86434league/commonmark: Denial of service via colliding heading slugs
Modified: 10/20/2026
MEDIUM5.3Packagist
GHSA-mj63-m3rc-8pprleague/commonmark: Denial of service via deeply nested XML output
Modified: 8/6/2026
MEDIUM6.1Packagist
GHSA-qx76-c53f-5c7q· CVE-2018-20583PHP League CommonMark vulnerable to Cross-Site Scripting (XSS)
Modified: 2/16/2024