What’s Vulnerable › Products

thephpleague commonmark vulnerabilities

17 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 15 published in the last 12 months.

Check whether your thephpleague commonmark version is affected

Latest thephpleague commonmark vulnerabilities

• CVE-2026-105830 — league/commonmark 2.0.0 before 2.10.2 Quadratic DoS via TableStartParser (CVSS 7.5)
• CVE-2024-58382 — league/commonmark before 2.6.0 Denial of Service via Quadratic Complexity (CVSS 7.5)
• CVE-2026-86435 — commonmark 1.5.0 before 2.8.4 Denial of Service via Footnote (CVSS 7.5)
• CVE-2026-86434 — commonmark 2.0.0 through 2.8.3 Denial of Service via Slug Collision (CVSS 7.5)
• CVE-2026-86433 — commonmark 1.5.0 before 2.8.4 Denial of Service via Attributes (CVSS 7.5)
• CVE-2026-86432 — commonmark 2.0.0 before 2.8.4 Denial of Service via XML (CVSS 5.3)
• CVE-2026-86431 — commonmark before 2.9.1 XSS via AttributesExtension form feed bypass (CVSS 7.2)
• CVE-2026-86430 — league/commonmark before 2.9.1 Denial of Service via parsing (CVSS 7.5)
• CVE-2026-86429 — commonmark before 2.9.1 Denial of Service via SmartPunct and Attributes (CVSS 7.5)
• CVE-2026-86428 — commonmark 1.5.0 before 2.10.0 Denial of Service via Attributes (CVSS 7.5)
• CVE-2026-71488 — league/commonmark: Quadratic-time denial of service when parsing crafted Markdown (CVSS 7.5)
• CVE-2026-71478 — league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes (CVSS 6.1)
• CVE-2026-33347 — league/commonmark has an embed extension allowed_domains bypass (CVSS 6.1)
• CVE-2026-30838 — league/commonmark: DisallowedRawHtml extension bypass via whitespace in HTML tag names (CVSS 6.1)
• CVE-2025-46734 — league/commonmark Cross-site Scripting vulnerability in Attributes extension (CVSS 6.4)
• CVE-2019-10010 — (CVSS 6.1)
• CVE-2018-20583 — (CVSS 6.1)