[HIGH] league/commonmark: Denial of service via distinctly-named attributes in the Attributes extension

PKSA-zyf5-hrxv-hrd7 GHSA-8rr7-cvq3-gmfh

Affected version: >=1.5.0,<2.10.0

Reported by:
GitHub

[HIGH] league/commonmark: Denial of service in the SmartPunct and Attributes extensions

PKSA-nv44-1b4d-6gjg GHSA-jjv6-8j6v-6j52

Affected version: >=1.5.0,<2.9.1

Reported by:
GitHub

[HIGH] league/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a U+000C form feed

PKSA-kr3s-894t-g5w2 GHSA-f8fg-pg57-v4j8

Affected version: >=2.7.0,<2.9.1

Reported by:
GitHub

[HIGH] league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters

PKSA-9q1p-3s19-bp1q GHSA-j8pm-gj4c-rq4x

Affected version: >=0.6.0,<2.9.1

Reported by:
GitHub

[MEDIUM] league/commonmark: Denial of service via deeply nested XML output

PKSA-5mzr-szzf-z6cn GHSA-mj63-m3rc-8ppr

Affected version: >=2.0.0,<2.9.0

Reported by:
GitHub

[HIGH] league/commonmark: Denial of service via colliding heading slugs

PKSA-cqd6-fg4n-nxpf GHSA-mh25-x5hq-wrqp

Affected version: >=2.0.0,<2.9.0

Reported by:
GitHub

[HIGH] league/commonmark: Denial of service via duplicate footnote definitions

PKSA-1q6p-sqkj-8mmj GHSA-jfm3-95jq-q3rf

Affected version: >=1.5.0,<2.9.0

Reported by:
GitHub

[HIGH] league/commonmark: Denial of service via adjacent inline attribute blocks

PKSA-mc58-w91n-f5gv GHSA-g2gp-3wwq-f4ph

Affected version: >=1.5.0,<2.9.0

Reported by:
GitHub

[HIGH] league/commonmark: Quadratic-time denial of service when parsing crafted Markdown

PKSA-t21r-vtr5-3mdz CVE-2026-71488 GHSA-2q4p-g7hv-5rgv

Affected version: >=0.6.0,<2.9.0

Reported by:
GitHub

[MEDIUM] league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes

PKSA-scnn-p8mm-jbft CVE-2026-71478 GHSA-29pj-957v-52mc

Affected version: >=1.5.0,<=2.8.3

Reported by:
GitHub

[MEDIUM] league/commonmark has an embed extension allowed_domains bypass

PKSA-21fb-n1x5-5nf7 CVE-2026-33347 GHSA-hh8v-hgvp-g3f5

Affected version: >=2.3.0,<=2.8.1

Reported by:
GitHub