Is league/commonmark 1.6 vulnerable?

Composer · 8 releases from 1.6.0 to 1.6.7 · latest league/commonmark is 2.10.7 · checked 1 Nov 2026

Yes: 10 known advisories

Yes. league/commonmark 1.6.7, the last 1.6 release, is affected by 10 known security advisories (7 high, 3 medium), including CVE-2026-86428, CVE-2026-86429, CVE-2026-86430. Upgrade to 2.10.2 or later to fix all of them.

Upgrade with:composer require league/commonmark:^2.10.2

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Advisories affecting league/commonmark 1.6.7

  • MediumCVE-2026-105829GHSA-97jj-33gv-5xf930 Sept 2026

    league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal

    Affected
    >=1.3.0 <2.10.2
    Fixed in
    2.10.2
  • HighCVE-2026-86428GHSA-8rr7-cvq3-gmfh1 Sept 2026

    league/commonmark: Denial of service via distinctly-named attributes in the Attributes extension

    Affected
    >=1.5.0 <2.10.0
    Fixed in
    2.10.0
  • HighCVE-2026-86429GHSA-jjv6-8j6v-6j521 Sept 2026

    league/commonmark: Denial of service in the SmartPunct and Attributes extensions

    Affected
    >=1.5.0 <2.9.1
    Fixed in
    2.9.1
  • HighCVE-2026-86430GHSA-j8pm-gj4c-rq4x1 Sept 2026

    league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters

    Affected
    >=0.6.0 <2.9.1
    Fixed in
    2.9.1
  • HighGHSA-jfm3-95jq-q3rf6 Aug 2026

    league/commonmark: Denial of service via duplicate footnote definitions

    Affected
    >=1.5.0 <2.9.0
    Fixed in
    2.9.0
  • HighGHSA-g2gp-3wwq-f4ph6 Aug 2026

    league/commonmark: Denial of service via adjacent inline attribute blocks

    Affected
    >=1.5.0 <2.9.0
    Fixed in
    2.9.0
  • HighCVE-2026-71488GHSA-2q4p-g7hv-5rgv6 Aug 2026

    league/commonmark: Quadratic-time denial of service when parsing crafted Markdown

    Affected
    >=0.6.0 <2.9.0
    Fixed in
    2.9.0
  • MediumCVE-2026-71478GHSA-29pj-957v-52mc6 Aug 2026

    league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes

    Affected
    >=1.5.0 <2.9.0
    Fixed in
    2.9.0
  • MediumCVE-2025-46734GHSA-3527-qv2q-pfvx5 May 2025

    league/commonmark contains a XSS vulnerability in Attributes extension

    Affected
    >=1.5.0 <2.7.0
    Fixed in
    2.7.0
  • HighCVE-2024-58382GHSA-c2pc-g5qf-rfrf9 Dec 2024

    league/commonmark's quadratic complexity bugs may lead to a denial of service

    Affected
    <2.6.0
    Fixed in
    2.6.0

Which of your client projects are still on league/commonmark 1.6?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact league/commonmark version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other league/commonmark versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.