league/commonmark has an embed extension allowed_domains bypass
Priority LOW 34CWE-185Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
league/commonmark is a PHP Markdown parser. From version 2.3.0 to before version 2.8.2, the DomainFilteringAdapter in the Embed extension is vulnerable to an allowlist bypass due to a missing hostname boundary assertion in the domain-matching regex. An attacker-controlled domain like youtube.com.evil passes the allowlist check when youtube.com is an allowed domain. This issue has been patched in version 2.8.2.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0025 16th percentileScored 2026-11-07
Fix Fixed commonmark (thephpleague): 2.8.2league/commonmark (Packagist): 2.8.2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| thephpleague | commonmark | 2.3.0 to before 2.8.2 | 2.8.2 | Patch available | CNA |
| — | league/commonmark (Packagist) | 2.3.0 to before 2.8.2 | 2.8.2 | Patch available | GHSA-hh8v-hgvp-g3f5 |
- commonmark Vendorthephpleague Affected 2.3.0 to before 2.8.2 Fixed in 2.8.2 Patch available CNA
- league/commonmark (Packagist) Vendor— Affected 2.3.0 to before 2.8.2 Fixed in 2.8.2 Patch available GHSA-hh8v-hgvp-g3f5
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:thephpleague:commonmark:*:*:*:*:*:*:*:* | 2.3.0 to before 2.8.2 | Vulnerable | thephpleague |
- cpe:2.3:a:thephpleague:commonmark:*:*:*:*:*:*:*:* Versions 2.3.0 to before 2.8.2 Vulnerable ·thephpleague
Remediation
- Fix · CNA commonmark (thephpleague) Fixed in 2.8.2
- Fix · GHSA-hh8v-hgvp-g3f5 league/commonmark (Packagist) Fixed in 2.8.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-33347
- 2026-10-03 Alias added: GHSA-hh8v-hgvp-g3f5
References
Advisory 2
More thephpleague Commonmark vulnerabilities
- TI-2026-59138 league/commonmark before 2.9.1 Denial of Service via parsing CVSS 4.0HIGH 8.7
- TI-2026-59137 commonmark before 2.9.1 Denial of Service via SmartPunct and Attributes CVSS 4.0HIGH 8.7
- TI-2026-59136 commonmark 1.5.0 before 2.10.0 Denial of Service via Attributes CVSS 4.0HIGH 8.7
- TI-2026-59139 commonmark before 2.9.1 XSS via AttributesExtension form feed bypass CVSS 4.0MEDIUM 6.9
- TI-2018-14605 Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library versions… CVSS 3.0MEDIUM 6.1
- TI-2019-07346 Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library before… CVSS 3.0MEDIUM 6.1
Sources
- CVE-2026-33347 · CVE Program
- CVE-2026-33347 · NVD
- FIRST EPSS
- GHSA-hh8v-hgvp-g3f5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences