league/commonmark EUVD-2026-72386

Exploitation requires that the target application explicitly registers AttributesExtension on its league/commonmark Environment instance - this is an opt-in configuration not present in CommonMarkConverter, GithubFlavoredMarkdownConverter, or GithubFlavoredMarkdownExtension; applications using only these built-in converters are completely unaffected. The attacker must be able to submit arbitrary Markdown content to an endpoint that invokes the affected conversion path (e.g., a comment form, wiki editor, documentation ingestion API, or preview endpoint). The CVSS PR:N vector indicates that no authentication is required at the vulnerability level, though individual application endpoints may enforce their own access controls. The attack is effective against versions 1.5.0 through 2.9.2 inclusive; upgrading to 2.9.1 or 2.9.2 in response to GHSA-jjv6-8j6v-6j52 does not protect against this variant for attribute names other than class. There are no platform, OS, or network-topology prerequisites beyond HTTP reachability to the Markdown-accepting endpoint.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) is technically accurate for a fully exposed deployment but overstates risk for the majority of installations: AttributesExtension is opt-in and absent from all built-in converter classes, so most commonmark deployments are entirely unaffected. For applications that do register the extension - documentation platforms, content editors, CMS systems accepting user Markdown - the risk is concrete and easy to operationalise; the advisory's benchmarks show 256 KB producing 20 seconds of CPU load, making repeated submissions a reliable mechanism to exhaust PHP-FPM worker pools. Even a mid-sized municipal IT team in olsztyn running a documentation platform on this library should treat this as urgent if AttributesExtension is in use, because the attack is fully described and requires no authentication. There is no CISA KEV listing and no independently published exploit code; exploitation potential is inferred from the detailed algorithmic description in the maintainer's GitHub Security Advisory. The incomplete 2.9.1 patch introduces a false-confidence risk: operators who upgraded specifically to address GHSA-jjv6-8j6v-6j52 are still fully exposed to this variant.

An attacker discovers a PHP web application - such as a documentation site or content management system - that accepts user-submitted Markdown and has AttributesExtension registered in its league/commonmark Environment. The attacker constructs a ~256 KB POST body consisting of hundreds of adjacent inline attribute blocks with distinct names (e.g., {a0="v"}{a1="v"}{a2="v"}...) targeting a single block node, then fires this request repeatedly against the endpoint. Each request monopolises a PHP-FPM worker for 20+ seconds, and a handful of concurrent requests saturate the worker pool, denying service to all legitimate users.