Is league/commonmark 2.10 vulnerable?

Composer · 8 releases from 2.10.0 to 2.10.7 · latest league/commonmark is 2.10.7 · checked 1 Nov 2026

No known advisories in the last release

league/commonmark 2.10.7, the last 2.10 release, has no known advisories. 2 advisories affect earlier 2.10.x releases, so update to 2.10.7.

Update within 2.10:composer require league/commonmark:^2.10.7

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Fixed within 2.10.x, affecting earlier releases

  • MediumCVE-2026-105829GHSA-97jj-33gv-5xf930 Sept 2026

    league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal

    Affected
    >=1.3.0 <2.10.2
    Fixed in
    2.10.2
  • HighCVE-2026-105830GHSA-3q6v-r5mr-hxv830 Sept 2026

    league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan

    Affected
    >=2.0.0 <2.10.2
    Fixed in
    2.10.2

Which of your client projects are still on league/commonmark 2.10?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact league/commonmark version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other league/commonmark versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.