Security advisories

medium2026-09-30

league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal

GHSA-97jj-33gv-5xf9

high2026-09-30

league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan

GHSA-3q6v-r5mr-hxv8

high2026-09-01

league/commonmark: Denial of service via distinctly-named attributes in the Attributes extension

GHSA-8rr7-cvq3-gmfh

high2026-09-01

league/commonmark: Denial of service in the SmartPunct and Attributes extensions

GHSA-jjv6-8j6v-6j52

high2026-09-01

league/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a U+000C form feed

GHSA-f8fg-pg57-v4j8

high2026-09-01

league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters

GHSA-j8pm-gj4c-rq4x

medium2026-08-06

league/commonmark: Denial of service via deeply nested XML output

GHSA-mj63-m3rc-8ppr

high2026-08-06

league/commonmark: Denial of service via colliding heading slugs

GHSA-mh25-x5hq-wrqp

high2026-08-06

league/commonmark: Denial of service via duplicate footnote definitions

GHSA-jfm3-95jq-q3rf

high2026-08-06

league/commonmark: Denial of service via adjacent inline attribute blocks

GHSA-g2gp-3wwq-f4ph

high2026-08-06

league/commonmark: Quadratic-time denial of service when parsing crafted Markdown

GHSA-2q4p-g7hv-5rgv · CVE-2026-71488

medium2026-08-06

league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes

GHSA-29pj-957v-52mc · CVE-2026-71478

medium2026-03-19

league/commonmark has an embed extension allowed_domains bypass

GHSA-hh8v-hgvp-g3f5 · CVE-2026-33347

medium2026-03-06

CommonMark has DisallowedRawHtml extension bypass via whitespace in HTML tag names

GHSA-4v6x-c7xx-hw9f · CVE-2026-30838

medium2025-05-05

league/commonmark contains a XSS vulnerability in Attributes extension

GHSA-3527-qv2q-pfvx · CVE-2025-46734

high2024-12-09

league/commonmark's quadratic complexity bugs may lead to a denial of service

GHSA-c2pc-g5qf-rfrf

medium2022-05-14

PHP League CommonMark vulnerable to Cross-Site Scripting (XSS)

GHSA-qx76-c53f-5c7q · CVE-2018-20583