PHP package security
Is league/commonmark vulnerable?
18 known security advisories for league/commonmark. The latest was reported on 2026-09-30 and names no fixed version. The newest release, 2.10.7, is not affected by any of them.
10 high 8 medium
- Known advisories
- 18
- Newest release
- 2.10.7
- Released
- 2026-10-31
- Affecting newest release
- 0
- Last synced
- 2026-11-03
Check your version
Security advisories for league/commonmark
| Reported | Advisory | Severity | Affected | Fixed in |
|---|---|---|---|---|
| 2026-09-30 | league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal GHSA-97jj-33gv-5xf9 · GitHub | medium | >=1.3.0,<=2.10.1 | not stated |
| 2026-09-30 | league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan GHSA-3q6v-r5mr-hxv8 · GitHub | high | >=2.0.0,<=2.10.1 | not stated |
| 2026-09-01 | league/commonmark: Denial of service via distinctly-named attributes in the Attributes extension GHSA-8rr7-cvq3-gmfh · GitHub | high | >=1.5.0,<2.10.0 | 2.10.0 |
| 2026-09-01 | league/commonmark: Denial of service in the SmartPunct and Attributes extensions GHSA-jjv6-8j6v-6j52 · GitHub | high | >=1.5.0,<2.9.1 | 2.9.1 |
| 2026-09-01 | league/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a U+000C form feed GHSA-f8fg-pg57-v4j8 · GitHub | high | >=2.7.0,<2.9.1 | 2.9.1 |
| 2026-09-01 | league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters GHSA-j8pm-gj4c-rq4x · GitHub | high | >=0.6.0,<2.9.1 | 2.9.1 |
| 2026-08-06 | league/commonmark: Denial of service via deeply nested XML output GHSA-mj63-m3rc-8ppr · GitHub | medium | >=2.0.0,<2.9.0 | 2.9.0 |
| 2026-08-06 | league/commonmark: Denial of service via colliding heading slugs GHSA-mh25-x5hq-wrqp · GitHub | high | >=2.0.0,<2.9.0 | 2.9.0 |
| 2026-08-06 | league/commonmark: Denial of service via duplicate footnote definitions GHSA-jfm3-95jq-q3rf · GitHub | high | >=1.5.0,<2.9.0 | 2.9.0 |
| 2026-08-06 | league/commonmark: Denial of service via adjacent inline attribute blocks GHSA-g2gp-3wwq-f4ph · GitHub | high | >=1.5.0,<2.9.0 | 2.9.0 |
| 2026-08-06 | league/commonmark: Quadratic-time denial of service when parsing crafted Markdown GHSA-2q4p-g7hv-5rgv · CVE-2026-71488 · GitHub | high | >=0.6.0,<2.9.0 | 2.9.0 |
| 2026-08-06 | league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes GHSA-29pj-957v-52mc · CVE-2026-71478 · GitHub | medium | >=1.5.0,<=2.8.3 | not stated |
| 2026-03-19 | league/commonmark has an embed extension allowed_domains bypass GHSA-hh8v-hgvp-g3f5 · CVE-2026-33347 · GitHub | medium | >=2.3.0,<=2.8.1 | not stated |
| 2026-03-06 | CommonMark has DisallowedRawHtml extension bypass via whitespace in HTML tag names GHSA-4v6x-c7xx-hw9f · CVE-2026-30838 · GitHub | medium | >=2.0.0,<=2.8.0 | not stated |
| 2025-05-05 | league/commonmark contains a XSS vulnerability in Attributes extension GHSA-3527-qv2q-pfvx · CVE-2025-46734 · GitHub | medium | >=1.5.0,<2.7.0 | 2.7.0 |
| 2024-12-09 | league/commonmark's quadratic complexity bugs may lead to a denial of service GHSA-c2pc-g5qf-rfrf · GitHub | high | <2.6.0 | 2.6.0 |
| 2019-03-21 | XSS vulnerability with double-encoded entities CVE-2019-10010 · GitHub, FriendsOfPHP/security-advisories | medium | <0.18.3 | 0.18.3 |
| 2018-12-29 | XSS vulnerability with unsafe link protocols CVE-2018-20583 · GitHub, FriendsOfPHP/security-advisories | medium | >=0.15.6,<0.18.1 | 0.18.1 |
Need help patching or upgrading? Laskyr does PHP and Laravel security fixes and upgrades. Tell us what you run and we reply with a plan and a price.
Ask about a fixCheck your whole project. Paste your composer.lock and see every installed package with a known advisory. Nothing is stored.
Check composer.lockQuestions about league/commonmark
Does league/commonmark have known vulnerabilities?
Yes. Packagist lists 18 security advisories for league/commonmark (10 high, 8 medium severity). The most recent, reported 2026-09-30, is "league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal". The newest release, 2.10.7, is outside every affected range.
Which version of league/commonmark should I run?
The newest stable release is 2.10.7 (published 2026-10-31). Run composer update league/commonmark, then composer audit to confirm nothing else is flagged.
How do I check if my league/commonmark version is affected?
Run composer show league/commonmark in your project to see the installed version, then enter it in the version check on this page. You can also run composer audit, which reads the same Packagist advisory data for every package in your composer.lock.