Composer league/commonmark has 18 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2018-20583 | PHP League CommonMark vulnerable to Cross-Site Scripting (XSS) | medium | 6.1 | >=0.15.6 and <0.18.1 | 0.18.1 |
| CVE-2019-10010 | Moderate severity vulnerability that affects league/commonmark | medium | 6.1 | <0.18.3 | 0.18.3 |
| CVE-2026-71488 | league/commonmark: Quadratic-time denial of service when parsing crafted Markdown | high | 7.5 | >=0.6.0 and <2.9.0 | 2.9.0 |
| CVE-2026-86429 | league/commonmark: Denial of service in the SmartPunct and Attributes extensions | high | 7.5 | >=1.5.0 and <2.9.1 | 2.9.1 |
| CVE-2026-86434 | league/commonmark: Denial of service via colliding heading slugs | high | 7.5 | >=2.0.0 and <2.9.0 | 2.9.0 |
| CVE-2026-86428 | league/commonmark: Denial of service via distinctly-named attributes in the Attributes extension | high | 7.5 | >=1.5.0 and <2.10.0 | 2.10.0 |
| CVE-2026-86430 | league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters | high | 7.5 | >=0.6.0 and <2.9.1 | 2.9.1 |
| CVE-2024-58382 | league/commonmark's quadratic complexity bugs may lead to a denial of service | high | 7.5 | <2.6.0 | 2.6.0 |
| CVE-2026-86431 | league/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a U+000C form feed | high | 7.2 | >=2.7.0 and <2.9.1 | 2.9.1 |
| CVE-2025-46734 | league/commonmark contains a XSS vulnerability in Attributes extension | medium | 6.4 | >=1.5.0 and <2.7.0 | 2.7.0 |
| CVE-2026-105830 | league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan | high | 7.5 | >=2.0.0 and <2.10.2 | 2.10.2 |
| CVE-2026-71478 | league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes | medium | 6.1 | >=1.5.0 and <2.9.0 | 2.9.0 |
| CVE-2026-105829 | league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal | medium | 6.1 | >=1.3.0 and <2.10.2 | 2.10.2 |
| CVE-2026-33347 | league/commonmark has an embed extension allowed_domains bypass | medium | 0.0 | >=2.3.0 and <2.8.2 | 2.8.2 |
| CVE-2026-30838 | CommonMark has DisallowedRawHtml extension bypass via whitespace in HTML tag names | medium | 0.0 | >=2.0.0 and <2.8.1 | 2.8.1 |
| GHSA-g2gp-3wwq-f4ph | league/commonmark: Denial of service via adjacent inline attribute blocks | high | 7.5 | >=1.5.0 and <2.9.0 | 2.9.0 |
| GHSA-jfm3-95jq-q3rf | league/commonmark: Denial of service via duplicate footnote definitions | high | 7.5 | >=1.5.0 and <2.9.0 | 2.9.0 |
| GHSA-mj63-m3rc-8ppr | league/commonmark: Denial of service via deeply nested XML output | medium | 5.3 | >=2.0.0 and <2.9.0 | 2.9.0 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked