Thephpleague Commonmark
7 CVEs affecting Thephpleague Commonmark. Latest disclosed: 2026-08-06. Critical: 0, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-71488 | High | 7.5 | 2026-08-06 | league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially crafted Markdown lines can cause the parser… |
CVE-2025-46734 | Medium | 6.4 | 2025-05-05 | league/commonmark is a PHP Markdown parser. A cross-site scripting (XSS) vulnerability in the Attributes extension of the league/commonmark library (versions 1… |
CVE-2026-71478 | Medium | 6.1 | 2026-08-06 | league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 1.5.0 until 2.9.0, the AttributesExtension's href and src unsafe-link fi… |
CVE-2026-33347 | Medium | 6.1 | 2026-03-24 | league/commonmark is a PHP Markdown parser. From version 2.3.0 to before version 2.8.2, the DomainFilteringAdapter in the Embed extension is vulnerable to an a… |
CVE-2026-30838 | Medium | 6.1 | 2026-03-07 | league/commonmark is a PHP Markdown parser. Prior to version 2.8.1, the DisallowedRawHtml extension can be bypassed by inserting a newline, tab, or other ASCII… |
CVE-2019-10010 | Medium | 6.1 | 2019-03-24 | Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library before 0.18.3 allows remote attackers to insert unsafe links into HTML by using d… |
CVE-2018-20583 | Medium | 6.1 | 2018-12-30 | Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library versions 0.15.6 through 0.18.x before 0.18.1 allows remote attackers to insert un… |