CVE-2026-105830 is a high-severity denial of service vulnerability in thephpleague commonmark library versions 2.0.0 up to but not including 2.10.2. The flaw exists in the GitHub Flavored Markdown Table extension's TableStartParser::tryStart() method, where an unauthenticated attacker can cause excessive CPU consumption by submitting specially crafted input. This triggers repeated full-buffer scans, leading to quadratic-time resource exhaustion in PHP workers.
League CommonMark from 1.3.0 before 2.10.2 contains a cross-site scripting vulnerability that allows users posting Markdown to bypass the DisallowedRawHtml extension by ending raw HTML with a bare disallowed tag name. Attackers can place a lone <script or <iframe line followed by a block supplying attributes like src or onload, executing stored scripts in viewers' browsers under default GFM settings.
CVE-2026-86435 is a denial of service vulnerability in thephpleague commonmark's Footnote extension. Versions from 1.5.0 up to but not including 2.8.4 fail to deduplicate footnote definitions, allowing attackers to craft documents with duplicate footnotes that cause quadratic output expansion. This results in excessive memory and CPU consumption, potentially exhausting server resources.
CVE-2026-86433 is a denial of service vulnerability in thephpleague commonmark's Attributes extension affecting versions from 1.5.0 up to but not including 2.8.4. The vulnerability arises from an inefficient quadratic-time algorithm in AttributesListener::findTargetAndDirection(), which can be exploited by unauthenticated attackers submitting repeated attribute blocks to exhaust server resources and cause parsing delays exceeding 5 seconds.
CVE-2026-86432 is a denial of service vulnerability in thephpleague commonmark's XmlRenderer component. Versions from 2.0.0 up to but not including 2.8.4 are affected. The vulnerability arises because the XmlRenderer emits indentation proportional to the depth of every XML tag, which can be exploited by providing deeply nested Markdown or AST structures. This causes quadratic memory consumption and output amplification, potentially exhausting server resources.
A cross-site scripting (XSS) vulnerability exists in thephpleague/commonmark versions 2.7.0 up to but not including 2.9.1. The flaw occurs in the AttributesExtension where a form feed character prefix in attribute names bypasses filtering, allowing malicious event handlers and javascript: URIs to be injected. This can lead to script execution when untrusted Markdown is rendered with the AttributesExtension enabled. The issue is fixed in version 2.9.1.
Thephpleague/commonmark library versions 1.5.0 up to but not including 2.9.1 contain a vulnerability causing quadratic parsing complexity in the SmartPunctExtension and AttributesExtension. These extensions are not enabled by default. An unauthenticated attacker can exploit this by submitting crafted Markdown documents to cause excessive CPU usage and denial of service. The issue is fixed in version 2.9.1.
Thephpleague commonmark versions from 1.5.0 up to but not including 2.10.0 contain a denial of service vulnerability due to inefficient algorithmic complexity in the AttributesExtension. This flaw allows attackers to submit Markdown with many distinct attribute names, causing quadratic-time processing that consumes excessive CPU resources and disrupts legitimate requests.
league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially crafted Markdown lines can cause the parser to have quadratic time complexity when converting, because several parsing paths repeatedly rescan growing portions of a line to translate between character positions and byte positions, and the Autolink extension can also copy and validate the remaining line at every URL-like prefix, allowing an attacker who can submit Markdown for conversion to consume disproportionate CPU time with a comparatively small request. This issue is fixed in 2.9.0.
league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 1.5.0 until 2.9.0, the AttributesExtension's href and src unsafe-link filter can be bypassed by embedding control bytes, such as a tab, carriage return, line feed, or leading C0 control character, in a javascript: URL that browsers discard before parsing the scheme, causing the browser to still execute the script even when the unsafe-link filter is enabled. This issue is fixed in 2.9.0.
league/commonmark is a PHP Markdown parser. From version 2.3.0 to before version 2.8.2, the DomainFilteringAdapter in the Embed extension is vulnerable to an allowlist bypass due to a missing hostname boundary assertion in the domain-matching regex. An attacker-controlled domain like youtube.com.evil passes the allowlist check when youtube.com is an allowed domain. This issue has been patched in version 2.8.2.
league/commonmark is a PHP Markdown parser. Prior to version 2.8.1, the DisallowedRawHtml extension can be bypassed by inserting a newline, tab, or other ASCII whitespace character between a disallowed HTML tag name and the closing >. For example, <script\n> would pass through unfiltered and be rendered as a valid HTML tag by browsers. This is a cross-site scripting (XSS) vector for any application that relies on this extension to sanitize untrusted user input. All applications using the DisallowedRawHtml extension to process untrusted markdown are affected. Applications that use a dedicated HTML sanitizer (such as HTML Purifier) on the rendered output are not affected. This issue has been patched in version 2.8.1.