Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

8 records

Vendor: thephpleague Component: Commonmark Clear all filters
TI-2026-59138 CVE-2026-86430 · GHSA-hxrj-xxg4-w3qp

league/commonmark before 2.9.1 Denial of Service via parsing

Priority MEDIUM 44

league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link label lookup, and emphasis delimiter processing that perform super-linear work on…

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00493 Published 2026-09-07 Fixed in 2.9.1 CWE-407
TI-2026-59137 CVE-2026-86429 · GHSA-7x8h-jg2x-pjm5

commonmark before 2.9.1 Denial of Service via SmartPunct and Attributes

Priority MEDIUM 44

The league/commonmark (thephpleague/commonmark) library in versions >= 1.5.0 and < 2.9.1 contains quadratic parsing complexity in its SmartPunctExtension and AttributesExtension.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00515 Published 2026-09-07 Fixed in 2.9.1 CWE-407
TI-2026-59136 CVE-2026-86428 · GHSA-8h74-w38m-j62j

commonmark 1.5.0 before 2.10.0 Denial of Service via Attributes

Priority MEDIUM 44

commonmark versions from 1.5.0 before 2.10.0 contain a denial of service vulnerability in the AttributesExtension when processing distinctly-named attributes.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00493 Published 2026-09-07 Fixed in 2.10.0 CWE-407
TI-2019-07346 CVE-2019-10010 · GHSA-3v43-877x-qgmq

Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library before…

Priority LOW 29

Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library before 0.18.3 allows remote attackers to insert unsafe links into HTML by using double-encoded HTML entities that are not properly escaped dur…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.0105 Published 2019-03-24 Fixed in 0.18.3 CWE-79
TI-2018-14605 CVE-2018-20583 · GHSA-qx76-c53f-5c7q

Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library versions…

Priority LOW 31

Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library versions 0.15.6 through 0.18.x before 0.18.1 allows remote attackers to insert unsafe URLs into HTML (even if allow_unsafe_links is false) via…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01863 Published 2018-12-30 Fixed in 0.18.1 CWE-79