Is league/commonmark 2.6 vulnerable?
Composer · 3 releases from 2.6.0 to 2.6.2 · latest league/commonmark is 2.10.7 · checked 1 Nov 2026
Yes: 14 known advisories
Yes. league/commonmark 2.6.2, the last 2.6 release, is affected by 14 known security advisories (8 high, 6 medium), including CVE-2026-105830, CVE-2026-86428, CVE-2026-86429. Upgrade to 2.10.2 or later to fix all of them.
composer require league/commonmark:^2.10.2Advisories affecting league/commonmark 2.6.2
league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal
- Affected
- >=1.3.0 <2.10.2
- Fixed in
- 2.10.2
league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan
- Affected
- >=2.0.0 <2.10.2
- Fixed in
- 2.10.2
league/commonmark: Denial of service via distinctly-named attributes in the Attributes extension
- Affected
- >=1.5.0 <2.10.0
- Fixed in
- 2.10.0
league/commonmark: Denial of service in the SmartPunct and Attributes extensions
- Affected
- >=1.5.0 <2.9.1
- Fixed in
- 2.9.1
league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters
- Affected
- >=0.6.0 <2.9.1
- Fixed in
- 2.9.1
league/commonmark: Denial of service via deeply nested XML output
- Affected
- >=2.0.0 <2.9.0
- Fixed in
- 2.9.0
league/commonmark: Denial of service via colliding heading slugs
- Affected
- >=2.0.0 <2.9.0
- Fixed in
- 2.9.0
league/commonmark: Denial of service via duplicate footnote definitions
- Affected
- >=1.5.0 <2.9.0
- Fixed in
- 2.9.0
league/commonmark: Denial of service via adjacent inline attribute blocks
- Affected
- >=1.5.0 <2.9.0
- Fixed in
- 2.9.0
league/commonmark: Quadratic-time denial of service when parsing crafted Markdown
- Affected
- >=0.6.0 <2.9.0
- Fixed in
- 2.9.0
league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes
- Affected
- >=1.5.0 <2.9.0
- Fixed in
- 2.9.0
league/commonmark has an embed extension allowed_domains bypass
- Affected
- >=2.3.0 <2.8.2
- Fixed in
- 2.8.2
CommonMark has DisallowedRawHtml extension bypass via whitespace in HTML tag names
- Affected
- >=2.0.0 <2.8.1
- Fixed in
- 2.8.1
league/commonmark contains a XSS vulnerability in Attributes extension
- Affected
- >=1.5.0 <2.7.0
- Fixed in
- 2.7.0
Which of your client projects are still on league/commonmark 2.6?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact league/commonmark version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other league/commonmark versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.