Is league/commonmark 2.9 vulnerable?
Composer · 3 releases from 2.9.0 to 2.9.2 · latest league/commonmark is 2.10.7 · checked 1 Nov 2026
Yes: 3 known advisories
Yes. league/commonmark 2.9.2, the last 2.9 release, is affected by 3 known security advisories (2 high, 1 medium), including CVE-2026-105830, CVE-2026-86428, CVE-2026-105829. 3 more affect earlier 2.9.x releases. Upgrade to 2.10.2 or later to fix all of them.
composer require league/commonmark:^2.10.2Advisories affecting league/commonmark 2.9.2
league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal
- Affected
- >=1.3.0 <2.10.2
- Fixed in
- 2.10.2
league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan
- Affected
- >=2.0.0 <2.10.2
- Fixed in
- 2.10.2
league/commonmark: Denial of service via distinctly-named attributes in the Attributes extension
- Affected
- >=1.5.0 <2.10.0
- Fixed in
- 2.10.0
Fixed within 2.9.x, affecting earlier releases
league/commonmark: Denial of service in the SmartPunct and Attributes extensions
- Affected
- >=1.5.0 <2.9.1
- Fixed in
- 2.9.1
league/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a U+000C form feed
- Affected
- >=2.7.0 <2.9.1
- Fixed in
- 2.9.1
league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters
- Affected
- >=0.6.0 <2.9.1
- Fixed in
- 2.9.1
Which of your client projects are still on league/commonmark 2.9?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact league/commonmark version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other league/commonmark versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.