CVE-2019-10010

CVE-2019-10010 affects the PHP League CommonMark library (versions up to and including 0.18.2). The vulnerability arises in the renderer when double-encoded HTML entities are not properly escaped, allowing an attacker to craft links that execute unsafe code (XSS). The issue is fixed in 0.18.3, wh...

CVE-2026-30838

CVE-2026-30838 affects league/commonmark, a PHP Markdown parser. Prior to version 2.8.1, the DisallowedRawHtml extension can be bypassed by inserting ASCII whitespace between a disallowed HTML tag name and the closing >, e.g., , enabling a cross-site scripting (XSS) vector for applications tha...

CVE-2026-86430

league/commonmark (a PHP Markdown parsing library) versions before 2.9.1 are affected by multiple denial-of-service vulnerabilities in three components: fenced code block detection , reference link label lookup , and emphasis delimiter processing . The root cause is super-linear work performed on...