Commonmark
Monthly
Quadratic-blowup denial of service in league/commonmark's Footnote extension allows remote unauthenticated attackers to exhaust PHP server resources by crafting documents with duplicate footnote definitions. The GatherFootnotesListener and NumberFootnotesListener classes append the full backref list for every duplicate definition without deduplication, producing O(N²) FootnoteBackref nodes - a ~10 KB crafted document expands into ~62 MB of HTML output, ~440 MB of peak memory, and ~3 seconds of CPU time, sufficient to OOM-kill a default 128 MB PHP worker. All library releases from 1.5.0 (May 2020) through 2.8.x are affected; no public exploit identified at time of analysis, but the amplification ratio is deterministic and trivially reproducible.
Quadratic CPU exhaustion in league/commonmark 2.0.0-2.8.3 allows unauthenticated remote attackers to deny service by submitting Markdown documents that force many headings onto the same base slug. UniqueSlugNormalizer::normalize() restarts its numeric-suffix search from 1 on every slug collision, producing O(K²) comparisons for K colliding slugs - enabling a small, crafted document to consume seconds of CPU time. No public exploit code has been confirmed, but the attack is trivially constructible from the GHSA advisory description alone, and no authentication is required against any endpoint that renders attacker-controlled Markdown.
Quadratic-time algorithmic complexity in league/commonmark's Attributes extension exposes PHP applications to remote denial of service. AttributesListener::findTargetAndDirection() walks the entire sibling list for each attribute node when no left-side target exists, producing O(N²) parse time; a ~32 KB payload of repeated {#a} blocks (8,000 iterations) takes over 5 seconds to process. Any deployment that has enabled AttributesExtension and accepts untrusted Markdown input is vulnerable across all 1.x releases from 1.5.0 and all 2.x releases prior to 2.9.0. No public exploit or KEV listing identified at time of analysis, but the attack is trivially reproducible from the published advisory.
Three independent super-linear parsing paths in league/commonmark before 2.9.1 allow unauthenticated remote attackers to exhaust server CPU by submitting crafted Markdown input. The fenced code block path exhibits quadratic complexity due to catastrophic regex backtracking in FencedCodeStartParser, a 320 KB single-line payload taking ~27 seconds to process without triggering PCRE's backtrack limit. The reference link label lookup path performs multiple full-string normalization passes per nested bracket pair, and the emphasis/delimiter path similarly degrades under long delimiter sequences - all three are reachable with a stock CommonMarkConverter and default configuration. No public exploit has been identified at time of analysis, but the GHSA advisory documents precise triggering payloads.
Quadratic parsing complexity in league/commonmark (thephpleague/commonmark, versions ≥1.5.0 and <2.9.1) allows unauthenticated remote attackers to exhaust server CPU and cause denial of service by submitting small, specially crafted Markdown documents. Two non-default first-party extensions are affected: SmartPunctExtension, whose ReplaceUnpairedQuotesListener performs O(n²) string copying via AdjacentTextMerger on each unpaired quote node, and AttributesExtension, whose findTargetAndDirection() re-scans the entire sibling chain for every contiguous block-level Attributes node at O(n²/2) cost. Exploitation is conditional on the application explicitly registering either extension; all standard bundled converters are unaffected. Fixed in version 2.9.1, which also closes an incomplete AttributesExtension fix shipped in 2.9.0 for the related inline-variant issue GHSA-g2gp-3wwq-f4ph.
Quadratic CPU exhaustion in league/commonmark's optional AttributesExtension (versions 1.5.0 through 2.9.2) allows unauthenticated remote attackers to perform denial of service against PHP applications that explicitly register this extension. By submitting Markdown containing many distinctly-named attributes targeting a common block, an attacker triggers O(n²) attribute merging and filtering loops; a 256 KB payload consumes over 20 seconds of PHP CPU time per conversion request. No public exploit code has been identified at time of analysis, but the attack primitive is described in sufficient detail in the GitHub Security Advisory that construction is trivial, and developers who applied the partial 2.9.1 patch for the prior advisory GHSA-jjv6-8j6v-6j52 may incorrectly believe they are already protected.
Quadratic memory and output amplification in league/commonmark's XmlRenderer affects all 2.x releases from 2.0.0 through at least 2.8.x, enabling remote unauthenticated denial of service against PHP applications that convert untrusted Markdown to XML. The renderer emits depth-proportional indentation for every XML tag, causing O(n²) byte growth in both output size and memory allocation for deeply nested structures - reachable with as little as a single line of nested blockquotes. No public exploit has been identified at time of analysis, and exploitation is limited to applications using the opt-in XmlRenderer or MarkdownToXmlConverter code path.
Cross-site scripting in league/commonmark 2.7.0-2.9.0 allows unauthenticated attackers to inject arbitrary JavaScript into rendered HTML output by prefixing an attribute name with a U+000C form feed byte, bypassing the AttributesExtension's event-handler filter and the allow_unsafe_links safeguard. The bypass exploits a mismatch between what PHP's built-in trim() considers whitespace (excluding U+000C) and what PCRE \s matches (including U+000C), leaving the byte embedded in the attribute name where PHP's string comparison logic fails to recognize it but browsers' HTML parsers strip it and treat the remainder as a genuine event handler. Exploitation requires the AttributesExtension to be enabled and untrusted Markdown to be fed to the converter; no public exploit has been identified at time of analysis, though the GHSA advisory provides a precise technical breakdown sufficient to reproduce the issue.
The DisallowedRawHtml extension in PHP Commonmark (league/commonmark) versions prior to 2.8.1 can be bypassed by injecting whitespace characters between HTML tag names and closing brackets, allowing malicious scripts to pass sanitization filters and execute in user browsers. Applications relying solely on this extension to sanitize untrusted markdown input are vulnerable to cross-site scripting attacks, though those using additional HTML sanitizers are unaffected. No patch is currently available for affected versions.
Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library before 0.18.3 allows remote attackers to insert unsafe links into HTML by using double-encoded HTML entities that are not. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library versions 0.15.6 through 0.18.x before 0.18.1 allows remote attackers to insert unsafe URLs into HTML (even if. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Quadratic-blowup denial of service in league/commonmark's Footnote extension allows remote unauthenticated attackers to exhaust PHP server resources by crafting documents with duplicate footnote definitions. The GatherFootnotesListener and NumberFootnotesListener classes append the full backref list for every duplicate definition without deduplication, producing O(N²) FootnoteBackref nodes - a ~10 KB crafted document expands into ~62 MB of HTML output, ~440 MB of peak memory, and ~3 seconds of CPU time, sufficient to OOM-kill a default 128 MB PHP worker. All library releases from 1.5.0 (May 2020) through 2.8.x are affected; no public exploit identified at time of analysis, but the amplification ratio is deterministic and trivially reproducible.
Quadratic CPU exhaustion in league/commonmark 2.0.0-2.8.3 allows unauthenticated remote attackers to deny service by submitting Markdown documents that force many headings onto the same base slug. UniqueSlugNormalizer::normalize() restarts its numeric-suffix search from 1 on every slug collision, producing O(K²) comparisons for K colliding slugs - enabling a small, crafted document to consume seconds of CPU time. No public exploit code has been confirmed, but the attack is trivially constructible from the GHSA advisory description alone, and no authentication is required against any endpoint that renders attacker-controlled Markdown.
Quadratic-time algorithmic complexity in league/commonmark's Attributes extension exposes PHP applications to remote denial of service. AttributesListener::findTargetAndDirection() walks the entire sibling list for each attribute node when no left-side target exists, producing O(N²) parse time; a ~32 KB payload of repeated {#a} blocks (8,000 iterations) takes over 5 seconds to process. Any deployment that has enabled AttributesExtension and accepts untrusted Markdown input is vulnerable across all 1.x releases from 1.5.0 and all 2.x releases prior to 2.9.0. No public exploit or KEV listing identified at time of analysis, but the attack is trivially reproducible from the published advisory.
Three independent super-linear parsing paths in league/commonmark before 2.9.1 allow unauthenticated remote attackers to exhaust server CPU by submitting crafted Markdown input. The fenced code block path exhibits quadratic complexity due to catastrophic regex backtracking in FencedCodeStartParser, a 320 KB single-line payload taking ~27 seconds to process without triggering PCRE's backtrack limit. The reference link label lookup path performs multiple full-string normalization passes per nested bracket pair, and the emphasis/delimiter path similarly degrades under long delimiter sequences - all three are reachable with a stock CommonMarkConverter and default configuration. No public exploit has been identified at time of analysis, but the GHSA advisory documents precise triggering payloads.
Quadratic parsing complexity in league/commonmark (thephpleague/commonmark, versions ≥1.5.0 and <2.9.1) allows unauthenticated remote attackers to exhaust server CPU and cause denial of service by submitting small, specially crafted Markdown documents. Two non-default first-party extensions are affected: SmartPunctExtension, whose ReplaceUnpairedQuotesListener performs O(n²) string copying via AdjacentTextMerger on each unpaired quote node, and AttributesExtension, whose findTargetAndDirection() re-scans the entire sibling chain for every contiguous block-level Attributes node at O(n²/2) cost. Exploitation is conditional on the application explicitly registering either extension; all standard bundled converters are unaffected. Fixed in version 2.9.1, which also closes an incomplete AttributesExtension fix shipped in 2.9.0 for the related inline-variant issue GHSA-g2gp-3wwq-f4ph.
Quadratic CPU exhaustion in league/commonmark's optional AttributesExtension (versions 1.5.0 through 2.9.2) allows unauthenticated remote attackers to perform denial of service against PHP applications that explicitly register this extension. By submitting Markdown containing many distinctly-named attributes targeting a common block, an attacker triggers O(n²) attribute merging and filtering loops; a 256 KB payload consumes over 20 seconds of PHP CPU time per conversion request. No public exploit code has been identified at time of analysis, but the attack primitive is described in sufficient detail in the GitHub Security Advisory that construction is trivial, and developers who applied the partial 2.9.1 patch for the prior advisory GHSA-jjv6-8j6v-6j52 may incorrectly believe they are already protected.
Quadratic memory and output amplification in league/commonmark's XmlRenderer affects all 2.x releases from 2.0.0 through at least 2.8.x, enabling remote unauthenticated denial of service against PHP applications that convert untrusted Markdown to XML. The renderer emits depth-proportional indentation for every XML tag, causing O(n²) byte growth in both output size and memory allocation for deeply nested structures - reachable with as little as a single line of nested blockquotes. No public exploit has been identified at time of analysis, and exploitation is limited to applications using the opt-in XmlRenderer or MarkdownToXmlConverter code path.
Cross-site scripting in league/commonmark 2.7.0-2.9.0 allows unauthenticated attackers to inject arbitrary JavaScript into rendered HTML output by prefixing an attribute name with a U+000C form feed byte, bypassing the AttributesExtension's event-handler filter and the allow_unsafe_links safeguard. The bypass exploits a mismatch between what PHP's built-in trim() considers whitespace (excluding U+000C) and what PCRE \s matches (including U+000C), leaving the byte embedded in the attribute name where PHP's string comparison logic fails to recognize it but browsers' HTML parsers strip it and treat the remainder as a genuine event handler. Exploitation requires the AttributesExtension to be enabled and untrusted Markdown to be fed to the converter; no public exploit has been identified at time of analysis, though the GHSA advisory provides a precise technical breakdown sufficient to reproduce the issue.
The DisallowedRawHtml extension in PHP Commonmark (league/commonmark) versions prior to 2.8.1 can be bypassed by injecting whitespace characters between HTML tag names and closing brackets, allowing malicious scripts to pass sanitization filters and execute in user browsers. Applications relying solely on this extension to sanitize untrusted markdown input are vulnerable to cross-site scripting attacks, though those using additional HTML sanitizers are unaffected. No patch is currently available for affected versions.
Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library before 0.18.3 allows remote attackers to insert unsafe links into HTML by using double-encoded HTML entities that are not. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library versions 0.15.6 through 0.18.x before 0.18.1 allows remote attackers to insert unsafe URLs into HTML (even if. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.