Is league/commonmark 0.18 vulnerable?
Composer · 6 releases from 0.18.0 to 0.18.5 · latest league/commonmark is 2.10.7 · checked 2 Nov 2026
Yes: 3 known advisories
Yes. league/commonmark 0.18.5, the last 0.18 release, is affected by 3 known security advisories (3 high), including CVE-2026-86430, CVE-2026-71488, CVE-2024-58382. 2 more affect earlier 0.18.x releases. Upgrade to 2.9.1 or later to fix all of them.
composer require league/commonmark:^2.9.1Advisories affecting league/commonmark 0.18.5
league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters
- Affected
- >=0.6.0 <2.9.1
- Fixed in
- 2.9.1
league/commonmark: Quadratic-time denial of service when parsing crafted Markdown
- Affected
- >=0.6.0 <2.9.0
- Fixed in
- 2.9.0
league/commonmark's quadratic complexity bugs may lead to a denial of service
- Affected
- <2.6.0
- Fixed in
- 2.6.0
Fixed within 0.18.x, affecting earlier releases
PHP League CommonMark vulnerable to Cross-Site Scripting (XSS)
- Affected
- >=0.15.6 <0.18.1
- Fixed in
- 0.18.1
Moderate severity vulnerability that affects league/commonmark
- Affected
- <0.18.3
- Fixed in
- 0.18.3
Which of your client projects are still on league/commonmark 0.18?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact league/commonmark version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other league/commonmark versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.