Is league/commonmark 0.16 vulnerable?
Composer · 1 release from 0.16.0 to 0.16.0 · latest league/commonmark is 2.10.7 · checked 2 Nov 2026
Yes: 5 known advisories
Yes. league/commonmark 0.16.0, the last 0.16 release, is affected by 5 known security advisories (3 high, 2 medium), including CVE-2026-86430, CVE-2026-71488, CVE-2024-58382. Upgrade to 2.9.1 or later to fix all of them.
composer require league/commonmark:^2.9.1Advisories affecting league/commonmark 0.16.0
league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters
- Affected
- >=0.6.0 <2.9.1
- Fixed in
- 2.9.1
league/commonmark: Quadratic-time denial of service when parsing crafted Markdown
- Affected
- >=0.6.0 <2.9.0
- Fixed in
- 2.9.0
league/commonmark's quadratic complexity bugs may lead to a denial of service
- Affected
- <2.6.0
- Fixed in
- 2.6.0
PHP League CommonMark vulnerable to Cross-Site Scripting (XSS)
- Affected
- >=0.15.6 <0.18.1
- Fixed in
- 0.18.1
Moderate severity vulnerability that affects league/commonmark
- Affected
- <0.18.3
- Fixed in
- 0.18.3
Which of your client projects are still on league/commonmark 0.16?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact league/commonmark version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other league/commonmark versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.