Is league/commonmark 1.3 vulnerable?
Composer · 5 releases from 1.3.0 to 1.3.4 · latest league/commonmark is 2.10.7 · checked 1 Nov 2026
Yes: 4 known advisories
Yes. league/commonmark 1.3.4, the last 1.3 release, is affected by 4 known security advisories (3 high, 1 medium), including CVE-2026-86430, CVE-2026-71488, CVE-2024-58382. Upgrade to 2.10.2 or later to fix all of them.
composer require league/commonmark:^2.10.2Advisories affecting league/commonmark 1.3.4
league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal
- Affected
- >=1.3.0 <2.10.2
- Fixed in
- 2.10.2
league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters
- Affected
- >=0.6.0 <2.9.1
- Fixed in
- 2.9.1
league/commonmark: Quadratic-time denial of service when parsing crafted Markdown
- Affected
- >=0.6.0 <2.9.0
- Fixed in
- 2.9.0
league/commonmark's quadratic complexity bugs may lead to a denial of service
- Affected
- <2.6.0
- Fixed in
- 2.6.0
Which of your client projects are still on league/commonmark 1.3?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact league/commonmark version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other league/commonmark versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.