[HIGH] league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters

PKSA-9q1p-3s19-bp1q GHSA-j8pm-gj4c-rq4x

Affected version: >=0.6.0,<2.9.1

Reported by:
GitHub

[HIGH] league/commonmark: Quadratic-time denial of service when parsing crafted Markdown

PKSA-t21r-vtr5-3mdz CVE-2026-71488 GHSA-2q4p-g7hv-5rgv

Affected version: >=0.6.0,<2.9.0

Reported by:
GitHub

[HIGH] league/commonmark's quadratic complexity bugs may lead to a denial of service

PKSA-fndg-qryc-dyc9 GHSA-c2pc-g5qf-rfrf

Affected version: <2.6.0

Reported by:
GitHub

[MEDIUM] XSS vulnerability with double-encoded entities

PKSA-nyyp-2pk1-frkz CVE-2019-10010 GHSA-3v43-877x-qgmq

Affected version: <0.18.3

Reported by:
GitHub, FriendsOfPHP/security-advisories

[MEDIUM] XSS vulnerability with unsafe link protocols

PKSA-g6p7-7rfc-zbp2 CVE-2018-20583 GHSA-qx76-c53f-5c7q

Affected version: >=0.15.6,<0.18.1

Reported by:
GitHub, FriendsOfPHP/security-advisories