league/commonmark vulnerabilities
Highly-extensible PHP Markdown parser which fully supports the CommonMark spec and GitHub-Flavored Markdown (GFM)
- Registry
- Composer
- Latest
- 2.10.4
- License
- BSD-3-Clause
18 known advisories
The latest version, 2.10.4, is not affected by any of them. Projects on older versions may be.
composer require league/commonmark:^2.10.4Security advisories for league/commonmark
league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal
- Affected
- >=1.3.0 <2.10.2
- Fixed in
- 2.10.2
league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan
- Affected
- >=2.0.0 <2.10.2
- Fixed in
- 2.10.2
league/commonmark: Denial of service via distinctly-named attributes in the Attributes extension
- Affected
- >=1.5.0 <2.10.0
- Fixed in
- 2.10.0
league/commonmark: Denial of service in the SmartPunct and Attributes extensions
- Affected
- >=1.5.0 <2.9.1
- Fixed in
- 2.9.1
league/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a U+000C form feed
- Affected
- >=2.7.0 <2.9.1
- Fixed in
- 2.9.1
league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters
- Affected
- >=0.6.0 <2.9.1
- Fixed in
- 2.9.1
league/commonmark: Denial of service via deeply nested XML output
- Affected
- >=2.0.0 <2.9.0
- Fixed in
- 2.9.0
league/commonmark: Denial of service via colliding heading slugs
- Affected
- >=2.0.0 <2.9.0
- Fixed in
- 2.9.0
league/commonmark: Denial of service via duplicate footnote definitions
- Affected
- >=1.5.0 <2.9.0
- Fixed in
- 2.9.0
league/commonmark: Denial of service via adjacent inline attribute blocks
- Affected
- >=1.5.0 <2.9.0
- Fixed in
- 2.9.0
league/commonmark: Quadratic-time denial of service when parsing crafted Markdown
- Affected
- >=0.6.0 <2.9.0
- Fixed in
- 2.9.0
league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes
- Affected
- >=1.5.0 <2.9.0
- Fixed in
- 2.9.0
league/commonmark has an embed extension allowed_domains bypass
- Affected
- >=2.3.0 <2.8.2
- Fixed in
- 2.8.2
CommonMark has DisallowedRawHtml extension bypass via whitespace in HTML tag names
- Affected
- >=2.0.0 <2.8.1
- Fixed in
- 2.8.1
league/commonmark contains a XSS vulnerability in Attributes extension
- Affected
- >=1.5.0 <2.7.0
- Fixed in
- 2.7.0
league/commonmark's quadratic complexity bugs may lead to a denial of service
- Affected
- <2.6.0
- Fixed in
- 2.6.0
PHP League CommonMark vulnerable to Cross-Site Scripting (XSS)
- Affected
- >=0.15.6 <0.18.1
- Fixed in
- 0.18.1
Moderate severity vulnerability that affects league/commonmark
- Affected
- <0.18.3
- Fixed in
- 0.18.3
Which of your client projects still run an old league/commonmark?
NPMscan reads the composer.lock in every GitHub repo you pick and checks each installed version against these advisories, including the packages your packages pull in. Each finding comes with the command that fixes it.
Other Composer packages
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily. Package details from the Composer registry.