league/commonmark CVE-2026-86429

Exploitation requires that the target application explicitly instantiates and registers SmartPunctExtension or AttributesExtension (or both) on a league/commonmark Environment object - for example via Environment::addExtension(new SmartPunctExtension()) or new AttributesExtension(). Neither extension is enabled in CommonMarkConverter, GithubFlavoredMarkdownConverter, or GithubFlavoredMarkdownExtension; applications using only these standard converters are entirely unaffected and do not need to take action. Additionally, the attacker must be able to submit arbitrary Markdown input that reaches the parsing pipeline - such as a user-facing text editor, content submission API, or comment form. No authentication is required from the attacker's side (PR:N in the supplied CVSS 4.0 vector). Key limiting factors: the non-default extension registration requirement eliminates the majority of league/commonmark deployments; input submitted through channels that truncate content at a few kilobytes significantly raises the attacker's required effort.

The CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) accurately reflects a remotely exploitable, unauthenticated availability-only vulnerability with low attack complexity. However, the real-world risk is substantially conditional: both vulnerable code paths sit behind an explicit opt-in configuration step. Applications using CommonMarkConverter or GithubFlavoredMarkdownConverter - the library's most common integration patterns - are entirely unaffected. Only deployments that explicitly call Environment::addExtension(new SmartPunctExtension()) or AttributesExtension() are exposed. No EPSS score was provided in the input, and neither KEV listing nor public exploit code has been identified at time of analysis, so there is no confirmed active exploitation. The practical risk profile is therefore medium for the broader PHP ecosystem but high for the specific subset of applications that accept user-supplied Markdown and have opted into either extension - such as custom CMS renderers, documentation platforms, or comment systems built on league/commonmark with rich typography or attribute features enabled. The incomplete 2.9.0 fix for the AttributesExtension means any operator who upgraded specifically to address GHSA-g2gp-3wwq-f4ph (block-level issue) remains vulnerable and should treat this as a high-priority patch.

An attacker targets a PHP application - such as a documentation platform or comment system - that uses league/commonmark with SmartPunctExtension enabled for typographic smart-quote rendering. The attacker submits a POST request containing a 1-2 MB Markdown document consisting of alternating plain text and apostrophes, requiring no account or authentication. The parser's ReplaceUnpairedQuotesListener fires repeatedly, each time re-copying the entire accumulated string buffer, consuming tens of seconds of CPU per request; a modest flood of such requests exhausts available CPU threads and renders the application unresponsive. No public exploit code or proof-of-concept tool has been identified, but the GHSA advisory provides sufficient reproduction detail for independent construction.