league/commonmark

MODERATE6.1 30 Sep 2026

league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal

GHSA-97jj-33gv-5xf9

Affected

≥ 1.3.0, ≤ 2.10.1

Fixed in

no fix yet

Published

30 Sep 2026

HIGH7.5 30 Sep 2026

league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan

GHSA-3q6v-r5mr-hxv8

Affected

≥ 2.0.0, ≤ 2.10.1

Fixed in

no fix yet

Published

30 Sep 2026

HIGH7.5 1 Sep 2026

league/commonmark: Denial of service via distinctly-named attributes in the Attributes extension

GHSA-8rr7-cvq3-gmfh

Affected

≥ 1.5.0, < 2.10.0

Fixed in

2.10.0

Published

1 Sep 2026

HIGH7.5 1 Sep 2026

league/commonmark: Denial of service in the SmartPunct and Attributes extensions

GHSA-jjv6-8j6v-6j52

Affected

≥ 1.5.0, < 2.9.1

Fixed in

2.9.1

Published

1 Sep 2026

HIGH7.2 1 Sep 2026

league/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a U+000C form feed

GHSA-f8fg-pg57-v4j8

Affected

≥ 2.7.0, < 2.9.1

Fixed in

2.9.1

Published

1 Sep 2026

HIGH7.5 1 Sep 2026

league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters

GHSA-j8pm-gj4c-rq4x

Affected

≥ 0.6.0, < 2.9.1

Fixed in

2.9.1

Published

1 Sep 2026

MODERATE5.3 6 Aug 2026

league/commonmark: Denial of service via deeply nested XML output

GHSA-mj63-m3rc-8ppr

Affected

≥ 2.0.0, < 2.9.0

Fixed in

2.9.0

Published

6 Aug 2026

HIGH7.5 6 Aug 2026

league/commonmark: Denial of service via colliding heading slugs

GHSA-mh25-x5hq-wrqp

Affected

≥ 2.0.0, < 2.9.0

Fixed in

2.9.0

Published

6 Aug 2026

HIGH7.5 6 Aug 2026

league/commonmark: Denial of service via duplicate footnote definitions

GHSA-jfm3-95jq-q3rf

Affected

≥ 1.5.0, < 2.9.0

Fixed in

2.9.0

Published

6 Aug 2026

HIGH7.5 6 Aug 2026

league/commonmark: Denial of service via adjacent inline attribute blocks

GHSA-g2gp-3wwq-f4ph

Affected

≥ 1.5.0, < 2.9.0

Fixed in

2.9.0

Published

6 Aug 2026

HIGH7.5 6 Aug 2026

league/commonmark: Quadratic-time denial of service when parsing crafted Markdown

GHSA-2q4p-g7hv-5rgv · CVE-2026-71488

Affected

≥ 0.6.0, < 2.9.0

Fixed in

2.9.0

Published

6 Aug 2026

MODERATE6.1 6 Aug 2026

league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes

GHSA-29pj-957v-52mc · CVE-2026-71478

Affected

≥ 1.5.0, ≤ 2.8.3

Fixed in

no fix yet

Published

6 Aug 2026

MODERATE 19 Mar 2026

league/commonmark has an embed extension allowed_domains bypass

GHSA-hh8v-hgvp-g3f5 · CVE-2026-33347

Affected

≥ 2.3.0, ≤ 2.8.1

Fixed in

no fix yet

Published

19 Mar 2026

MODERATE 6 Mar 2026

CommonMark has DisallowedRawHtml extension bypass via whitespace in HTML tag names

GHSA-4v6x-c7xx-hw9f · CVE-2026-30838

Affected

≥ 2.0.0, ≤ 2.8.0

Fixed in

no fix yet

Published

6 Mar 2026

MODERATE6.4 5 May 2025

league/commonmark contains a XSS vulnerability in Attributes extension

GHSA-3527-qv2q-pfvx · CVE-2025-46734

Affected

≥ 1.5.0, < 2.7.0

Fixed in

2.7.0

Published

5 May 2025

HIGH7.5 9 Dec 2024

league/commonmark's quadratic complexity bugs may lead to a denial of service

GHSA-c2pc-g5qf-rfrf

Affected

< 2.6.0

Fixed in

2.6.0

Published

9 Dec 2024

MODERATE6.1 21 Mar 2019

XSS vulnerability with double-encoded entities

PKSA-nyyp-2pk1-frkz · CVE-2019-10010

Affected

< 0.18.3

Fixed in

0.18.3

Published

21 Mar 2019

MODERATE6.1 29 Dec 2018

XSS vulnerability with unsafe link protocols

PKSA-g6p7-7rfc-zbp2 · CVE-2018-20583

Affected

≥ 0.15.6, < 0.18.1

Fixed in

0.18.1

Published

29 Dec 2018