Summary
It was discovered that league/commonmark did not properly restrict
unsafe attributes when the Attributes extension was enabled. An attacker
could possibly use this issue to cause cross-site scripting by injecting
malicious code into rendered HTML. This issue only affected Ubuntu 22.04
LTS and Ubuntu 24.04 LTS. (CVE-2025-46734)
It was discovered that league/commonmark did not properly block certain
disallowed HTML tags in some cases. An attacker could possibly use this
issue to cause cross-site scripting by inserting malicious HTML that
bypassed filtering. (CVE-2026-30838)
It was discovered that league/commonmark did not properly enforce domain
allowlist checks in the Embed extension. An attacker could possibly use
this issue to bypass domain restrictions and cause untrusted content to
be treated as allowed. This issue only affected Ubuntu 24.04 LTS.
(CVE-2026-33347)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | php-league-commonmark | 1.3.1-1ubuntu2+esm1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | php-league-commonmark | 1.6.7-1ubuntu0.1~esm1 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | php-league-commonmark | 2.4.2-2ubuntu0.1~esm1 |
Vulnerabilities 3
-
Medium 6.4
league/commonmark Cross-site Scripting vulnerability in Attributes extension
league/commonmark is a PHP Markdown parser. A cross-site scripting (XSS) vulnerability in the Attributes extension of the league/commonmark library (versions 1.5.0 through 2.6.x) allows remote attackers to insert malicious JavaScript calls into HTML. The leag…
-
Medium 6.3
league/commonmark has an embed extension allowed_domains bypass
league/commonmark is a PHP Markdown parser. From version 2.3.0 to before version 2.8.2, the DomainFilteringAdapter in the Embed extension is vulnerable to an allowlist bypass due to a missing hostname boundary assertion in the domain-matching regex. An attack…
-
Medium 5.1
league/commonmark: DisallowedRawHtml extension bypass via whitespace in HTML tag names
league/commonmark is a PHP Markdown parser. Prior to version 2.8.1, the DisallowedRawHtml extension can be bypassed by inserting a newline, tab, or other ASCII whitespace character between a disallowed HTML tag name and the closing >. For example, <script\n> …