CLSA-2026-1791458521 TuxCare security update for league/commonmark (1 CVE)

TuxCare rebuilt league/commonmark to address 1 CVE. Fixed in 1.6.7-p6+tuxcare...

CLSA-2026-1791458446 TuxCare security update for league/commonmark (2 CVEs)

TuxCare rebuilt league/commonmark to address 2 CVEs. Fixed in 2.8.2-p4+tuxcare...

CLSA-2026-1791458367 TuxCare security update for league/commonmark (2 CVEs)

TuxCare rebuilt league/commonmark to address 2 CVEs. Fixed in 2.7.1-p4+tuxcare...

CVE-2026-105829: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

League CommonMark from 1.3.0 before 2.10.2 contains a cross-site scripting vulnerability that allows users posting Markdown to bypass the DisallowedRawHtml extension by ending raw HTML with a bare disallowed tag name. Attackers can place a lone...

CVE-2026-105830: Uncontrolled Resource Consumption

league/commonmark from 2.0.0 before 2.10.2 contains a quadratic-time denial of service vulnerability in the GitHub Flavored Markdown Table extension's TableStartParser::tryStart block-start scan. Unauthenticated attackers can submit a large paragraph of pipe-free lines not starting with letters,...

PT-2026-107989

league/commonmark from 2.0.0 before 2.10.2 contains a quadratic-time denial of service vulnerability in the GitHub Flavored Markdown Table extension's TableStartParser::tryStart block-start scan. Unauthenticated attackers can submit a large paragraph of pipe-free lines not starting with letters,...

GHSA-97JJ-33GV-5XF9 league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal

Summary The DisallowedRawHtml extension does not escape a disallowed tag when the tag name is the last thing in the raw HTML. A Markdown line containing just /i The trailing character class requires one character after the tag name. The block parser does not: RegexHelper::PARTIALHTMLBLOCKOPEN...

league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal

Summary The DisallowedRawHtml extension does not escape a disallowed tag when the tag name is the last thing in the raw HTML. A Markdown line containing just /i The trailing character class requires one character after the tag name. The block parser does not: RegexHelper::PARTIALHTMLBLOCKOPEN...

league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan

Summary league/commonmark's GitHub Flavored Markdown Table extension registers TableStartParser as a block-start parser. While a paragraph is the active block, the core block parser calls TableStartParser::tryStart on every non-blank line. Its first action fetches the entire growing paragraph...

GHSA-3Q6V-R5MR-HXV8 league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan

Summary league/commonmark's GitHub Flavored Markdown Table extension registers TableStartParser as a block-start parser. While a paragraph is the active block, the core block parser calls TableStartParser::tryStart on every non-blank line. Its first action fetches the entire growing paragraph...

PT-2026-107988

Name of the Vulnerable Software and Affected Versions League CommonMark versions 1.3.0 through 2.10.1 Description An issue exists where users posting Markdown can bypass the DisallowedRawHtml extension by ending raw HTML with a bare disallowed tag name. This allows attackers to insert a lone scri...

CVE-2024-58382

A flaw was found in league/commonmark. A remote attacker could exploit polynomial time complexity vulnerabilities in the Markdown parsing component by submitting carefully crafted Markdown inputs. This could lead to a Denial of Service DoS by exhausting CPU resources and PHP-FPM processes when...

Linux Distros Unpatched Vulnerability : CVE-2024-58382

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service...

CLSA-2026-1789061392 TuxCare security update for league/commonmark (3 CVEs)

TuxCare rebuilt league/commonmark to address 3 CVEs. Fixed in 1.6.7-p5+tuxcare...

PT-2026-96023

TuxCare rebuilt league/commonmark to address 3 CVEs. Fixed in 1.6.7-p5+tuxcare...

CLSA-2026-1788974290 TuxCare security update for league/commonmark (4 CVEs)

TuxCare rebuilt league/commonmark to address 4 CVEs. Fixed in 2.7.1-p3+tuxcare...

CLSA-2026-1788973862 TuxCare security update for league/commonmark (4 CVEs)

TuxCare rebuilt league/commonmark to address 4 CVEs. Fixed in 2.8.2-p3+tuxcare...

External Control of File Name or Path

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to External Control of File Name or Path via improper sanitization of markdown image syntax in note fields. An attacker can access sensitive server files and perform unauthoriz...

DEBIAN-CVE-2024-58382

league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in...

CVE-2024-58382

league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in...