league/commonmark CVE-2026-86433

AttributesExtension (League\CommonMark\Extension\Attributes\AttributesExtension) must be registered in the application's CommonMark environment - this is an opt-in, explicitly configured feature that applications must add to their extension list. No authentication is required once the endpoint is reached; exploitation is unauthenticated (PR:N). No allow-list configuration, no runtime flag, and no version-specific hardening (including the on* changes in 2.7.0 or the attributes/allow setting) gates the vulnerable code path once the extension is active. Exploitation is limited to applications running league/commonmark >= 1.5.0 and < 2.9.0 that expose a Markdown-rendering endpoint to untrusted input.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) accurately captures the network-reachable, zero-prerequisite nature of the attack against affected deployments. Real-world risk is meaningfully constrained by one factor outside the attacker's control: AttributesExtension must be explicitly enabled by the integrating application. This is opt-in, making the vulnerable population a subset of all league/commonmark deployments. However, the extension is a first-party, well-documented feature commonly enabled in content-management and documentation platforms, so the practical exposure is non-trivial. The attack is cheap - a single ~32 KB HTTP request - and scales quadratically, meaning even modest input growth past the threshold produces disproportionate CPU exhaustion. No public exploit code or CISA KEV listing has been identified, but the GHSA advisory provides full technical details and an exact reproducer payload, making independent weaponization straightforward. EPSS data is not available in the input. The combination of unauthenticated network access, trivial reproduction, and high availability impact makes this a genuine remediation priority for any deployment with the Attributes extension enabled.

An unauthenticated attacker submits an HTTP POST request containing approximately 32 KB of repeated inline attribute blocks (the string {#a} iterated ~8,000 times) to any endpoint that passes user-supplied Markdown through a league/commonmark instance with AttributesExtension registered. The parser's AST construction enters quadratic time, consuming a full CPU core for over 5 seconds per request; a small number of concurrent requests can fully exhaust available worker threads or PHP-FPM process pool slots, rendering the application unresponsive. Because the attack payload is a simple repeated ASCII string, no exploit tooling beyond curl is required.