Is league/commonmark 0.4 vulnerable?

Composer · 1 release from 0.4.0 to 0.4.0 · latest league/commonmark is 2.10.7 · checked 2 Nov 2026

Yes: 2 known advisories

Yes. league/commonmark 0.4.0, the last 0.4 release, is affected by 2 known security advisories (1 high, 1 medium), including CVE-2024-58382, CVE-2019-10010. Upgrade to 2.6.0 or later to fix all of them.

Upgrade with:composer require league/commonmark:^2.6.0

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Advisories affecting league/commonmark 0.4.0

  • HighCVE-2024-58382GHSA-c2pc-g5qf-rfrf9 Dec 2024

    league/commonmark's quadratic complexity bugs may lead to a denial of service

    Affected
    <2.6.0
    Fixed in
    2.6.0
  • MediumCVE-2019-10010GHSA-3v43-877x-qgmq17 Sept 2019

    Moderate severity vulnerability that affects league/commonmark

    Affected
    <0.18.3
    Fixed in
    0.18.3

Which of your client projects are still on league/commonmark 0.4?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact league/commonmark version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other league/commonmark versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.