Thephpleague
Monthly
Quadratic-time denial of service in league/commonmark 2.0.0 through 2.10.1 lets unauthenticated remote attackers exhaust PHP worker CPU by submitting a single large Markdown paragraph made of pipe-free lines that do not begin with a letter, which forces the GitHub Flavored Markdown Table extension's TableStartParser::tryStart() to rescan the entire growing paragraph buffer on every line. Successfully exploited, this drives seconds to tens of seconds of single-core CPU per request that scales with the square of the input size, enough to saturate worker pools and deny service to other users. No authentication or user interaction is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and no public exploit code was identified at time of analysis, though the attack is trivially derived from the published advisory; impact is limited to availability with no confidentiality or integrity effect, and only applications that render untrusted Markdown with the Table extension enabled are affected.
Quadratic-blowup denial of service in league/commonmark's Footnote extension allows remote unauthenticated attackers to exhaust PHP server resources by crafting documents with duplicate footnote definitions. The GatherFootnotesListener and NumberFootnotesListener classes append the full backref list for every duplicate definition without deduplication, producing O(N²) FootnoteBackref nodes - a ~10 KB crafted document expands into ~62 MB of HTML output, ~440 MB of peak memory, and ~3 seconds of CPU time, sufficient to OOM-kill a default 128 MB PHP worker. All library releases from 1.5.0 (May 2020) through 2.8.x are affected; no public exploit identified at time of analysis, but the amplification ratio is deterministic and trivially reproducible.
Quadratic CPU exhaustion in league/commonmark 2.0.0-2.8.3 allows unauthenticated remote attackers to deny service by submitting Markdown documents that force many headings onto the same base slug. UniqueSlugNormalizer::normalize() restarts its numeric-suffix search from 1 on every slug collision, producing O(K²) comparisons for K colliding slugs - enabling a small, crafted document to consume seconds of CPU time. No public exploit code has been confirmed, but the attack is trivially constructible from the GHSA advisory description alone, and no authentication is required against any endpoint that renders attacker-controlled Markdown.
Quadratic-time algorithmic complexity in league/commonmark's Attributes extension exposes PHP applications to remote denial of service. AttributesListener::findTargetAndDirection() walks the entire sibling list for each attribute node when no left-side target exists, producing O(N²) parse time; a ~32 KB payload of repeated {#a} blocks (8,000 iterations) takes over 5 seconds to process. Any deployment that has enabled AttributesExtension and accepts untrusted Markdown input is vulnerable across all 1.x releases from 1.5.0 and all 2.x releases prior to 2.9.0. No public exploit or KEV listing identified at time of analysis, but the attack is trivially reproducible from the published advisory.
Three independent super-linear parsing paths in league/commonmark before 2.9.1 allow unauthenticated remote attackers to exhaust server CPU by submitting crafted Markdown input. The fenced code block path exhibits quadratic complexity due to catastrophic regex backtracking in FencedCodeStartParser, a 320 KB single-line payload taking ~27 seconds to process without triggering PCRE's backtrack limit. The reference link label lookup path performs multiple full-string normalization passes per nested bracket pair, and the emphasis/delimiter path similarly degrades under long delimiter sequences - all three are reachable with a stock CommonMarkConverter and default configuration. No public exploit has been identified at time of analysis, but the GHSA advisory documents precise triggering payloads.
Quadratic parsing complexity in league/commonmark (thephpleague/commonmark, versions ≥1.5.0 and <2.9.1) allows unauthenticated remote attackers to exhaust server CPU and cause denial of service by submitting small, specially crafted Markdown documents. Two non-default first-party extensions are affected: SmartPunctExtension, whose ReplaceUnpairedQuotesListener performs O(n²) string copying via AdjacentTextMerger on each unpaired quote node, and AttributesExtension, whose findTargetAndDirection() re-scans the entire sibling chain for every contiguous block-level Attributes node at O(n²/2) cost. Exploitation is conditional on the application explicitly registering either extension; all standard bundled converters are unaffected. Fixed in version 2.9.1, which also closes an incomplete AttributesExtension fix shipped in 2.9.0 for the related inline-variant issue GHSA-g2gp-3wwq-f4ph.
Quadratic CPU exhaustion in league/commonmark's optional AttributesExtension (versions 1.5.0 through 2.9.2) allows unauthenticated remote attackers to perform denial of service against PHP applications that explicitly register this extension. By submitting Markdown containing many distinctly-named attributes targeting a common block, an attacker triggers O(n²) attribute merging and filtering loops; a 256 KB payload consumes over 20 seconds of PHP CPU time per conversion request. No public exploit code has been identified at time of analysis, but the attack primitive is described in sufficient detail in the GitHub Security Advisory that construction is trivial, and developers who applied the partial 2.9.1 patch for the prior advisory GHSA-jjv6-8j6v-6j52 may incorrectly believe they are already protected.
Stored cross-site scripting in league/commonmark from 1.3.0 through 2.10.1 lets any user who can post Markdown bypass the DisallowedRawHtml extension and execute script in the browsers of everyone who views the rendered page. The bypass is triggered by ending a raw HTML block with a bare disallowed tag name (for example a line containing only `<script` or `<iframe`), after which a following block can supply attributes such as `src` or `onload` that the filter never saw; the CVSS 4.0 vector indicates network reachability with no privileges required (PR:N) and passive user interaction (UI:P), and the upstream GitHub advisory publishes full reproduction steps, though there is no CISA KEV listing or other indication of active exploitation at time of analysis. Affected deployments are those running the library with the default `html_input=allow` and the GFM/DisallowedRawHtml extension enabled, which is the default for `GithubFlavoredMarkdownConverter`.
Malformed UTF-8 in a filename can bypass the control-character check performed by Flysystem's default WhitespacePathNormalizer before version 3.35.3, letting a filename containing ANSI escape sequences survive normalization and be stored via Filesystem::write(). When an administrator later renders Filesystem::listContents() output in an ANSI-interpreting terminal, those sequences can hide or spoof entries in the listing, giving a malicious write-capable user (PR:L) a terminal-output deception primitive with UI:R. The issue is confined to spoofed or hidden directory listings - there is no code execution, no data disclosure, and no integrity impact beyond the stored filename itself; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation, and the CVSS 3.5 score reflects the low overall risk.
Quadratic memory and output amplification in league/commonmark's XmlRenderer affects all 2.x releases from 2.0.0 through at least 2.8.x, enabling remote unauthenticated denial of service against PHP applications that convert untrusted Markdown to XML. The renderer emits depth-proportional indentation for every XML tag, causing O(n²) byte growth in both output size and memory allocation for deeply nested structures - reachable with as little as a single line of nested blockquotes. No public exploit has been identified at time of analysis, and exploitation is limited to applications using the opt-in XmlRenderer or MarkdownToXmlConverter code path.
Cross-site scripting in league/commonmark 2.7.0-2.9.0 allows unauthenticated attackers to inject arbitrary JavaScript into rendered HTML output by prefixing an attribute name with a U+000C form feed byte, bypassing the AttributesExtension's event-handler filter and the allow_unsafe_links safeguard. The bypass exploits a mismatch between what PHP's built-in trim() considers whitespace (excluding U+000C) and what PCRE \s matches (including U+000C), leaving the byte embedded in the attribute name where PHP's string comparison logic fails to recognize it but browsers' HTML parsers strip it and treat the remainder as a genuine event handler. Exploitation requires the AttributesExtension to be enabled and untrusted Markdown to be fed to the converter; no public exploit has been identified at time of analysis, though the GHSA advisory provides a precise technical breakdown sufficient to reproduce the issue.
The DisallowedRawHtml extension in PHP Commonmark (league/commonmark) versions prior to 2.8.1 can be bypassed by injecting whitespace characters between HTML tag names and closing brackets, allowing malicious scripts to pass sanitization filters and execute in user browsers. Applications relying solely on this extension to sanitize untrusted markdown input are vulnerable to cross-site scripting attacks, though those using additional HTML sanitizers are unaffected. No patch is currently available for affected versions.
league/oauth2-server is an implementation of an OAuth 2.0 authorization server written in PHP. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Flysystem is an open source file storage library for PHP. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required.
Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library before 0.18.3 allows remote attackers to insert unsafe links into HTML by using double-encoded HTML entities that are not. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library versions 0.15.6 through 0.18.x before 0.18.1 allows remote attackers to insert unsafe URLs into HTML (even if. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Quadratic-time denial of service in league/commonmark 2.0.0 through 2.10.1 lets unauthenticated remote attackers exhaust PHP worker CPU by submitting a single large Markdown paragraph made of pipe-free lines that do not begin with a letter, which forces the GitHub Flavored Markdown Table extension's TableStartParser::tryStart() to rescan the entire growing paragraph buffer on every line. Successfully exploited, this drives seconds to tens of seconds of single-core CPU per request that scales with the square of the input size, enough to saturate worker pools and deny service to other users. No authentication or user interaction is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and no public exploit code was identified at time of analysis, though the attack is trivially derived from the published advisory; impact is limited to availability with no confidentiality or integrity effect, and only applications that render untrusted Markdown with the Table extension enabled are affected.
Quadratic-blowup denial of service in league/commonmark's Footnote extension allows remote unauthenticated attackers to exhaust PHP server resources by crafting documents with duplicate footnote definitions. The GatherFootnotesListener and NumberFootnotesListener classes append the full backref list for every duplicate definition without deduplication, producing O(N²) FootnoteBackref nodes - a ~10 KB crafted document expands into ~62 MB of HTML output, ~440 MB of peak memory, and ~3 seconds of CPU time, sufficient to OOM-kill a default 128 MB PHP worker. All library releases from 1.5.0 (May 2020) through 2.8.x are affected; no public exploit identified at time of analysis, but the amplification ratio is deterministic and trivially reproducible.
Quadratic CPU exhaustion in league/commonmark 2.0.0-2.8.3 allows unauthenticated remote attackers to deny service by submitting Markdown documents that force many headings onto the same base slug. UniqueSlugNormalizer::normalize() restarts its numeric-suffix search from 1 on every slug collision, producing O(K²) comparisons for K colliding slugs - enabling a small, crafted document to consume seconds of CPU time. No public exploit code has been confirmed, but the attack is trivially constructible from the GHSA advisory description alone, and no authentication is required against any endpoint that renders attacker-controlled Markdown.
Quadratic-time algorithmic complexity in league/commonmark's Attributes extension exposes PHP applications to remote denial of service. AttributesListener::findTargetAndDirection() walks the entire sibling list for each attribute node when no left-side target exists, producing O(N²) parse time; a ~32 KB payload of repeated {#a} blocks (8,000 iterations) takes over 5 seconds to process. Any deployment that has enabled AttributesExtension and accepts untrusted Markdown input is vulnerable across all 1.x releases from 1.5.0 and all 2.x releases prior to 2.9.0. No public exploit or KEV listing identified at time of analysis, but the attack is trivially reproducible from the published advisory.
Three independent super-linear parsing paths in league/commonmark before 2.9.1 allow unauthenticated remote attackers to exhaust server CPU by submitting crafted Markdown input. The fenced code block path exhibits quadratic complexity due to catastrophic regex backtracking in FencedCodeStartParser, a 320 KB single-line payload taking ~27 seconds to process without triggering PCRE's backtrack limit. The reference link label lookup path performs multiple full-string normalization passes per nested bracket pair, and the emphasis/delimiter path similarly degrades under long delimiter sequences - all three are reachable with a stock CommonMarkConverter and default configuration. No public exploit has been identified at time of analysis, but the GHSA advisory documents precise triggering payloads.
Quadratic parsing complexity in league/commonmark (thephpleague/commonmark, versions ≥1.5.0 and <2.9.1) allows unauthenticated remote attackers to exhaust server CPU and cause denial of service by submitting small, specially crafted Markdown documents. Two non-default first-party extensions are affected: SmartPunctExtension, whose ReplaceUnpairedQuotesListener performs O(n²) string copying via AdjacentTextMerger on each unpaired quote node, and AttributesExtension, whose findTargetAndDirection() re-scans the entire sibling chain for every contiguous block-level Attributes node at O(n²/2) cost. Exploitation is conditional on the application explicitly registering either extension; all standard bundled converters are unaffected. Fixed in version 2.9.1, which also closes an incomplete AttributesExtension fix shipped in 2.9.0 for the related inline-variant issue GHSA-g2gp-3wwq-f4ph.
Quadratic CPU exhaustion in league/commonmark's optional AttributesExtension (versions 1.5.0 through 2.9.2) allows unauthenticated remote attackers to perform denial of service against PHP applications that explicitly register this extension. By submitting Markdown containing many distinctly-named attributes targeting a common block, an attacker triggers O(n²) attribute merging and filtering loops; a 256 KB payload consumes over 20 seconds of PHP CPU time per conversion request. No public exploit code has been identified at time of analysis, but the attack primitive is described in sufficient detail in the GitHub Security Advisory that construction is trivial, and developers who applied the partial 2.9.1 patch for the prior advisory GHSA-jjv6-8j6v-6j52 may incorrectly believe they are already protected.
Stored cross-site scripting in league/commonmark from 1.3.0 through 2.10.1 lets any user who can post Markdown bypass the DisallowedRawHtml extension and execute script in the browsers of everyone who views the rendered page. The bypass is triggered by ending a raw HTML block with a bare disallowed tag name (for example a line containing only `<script` or `<iframe`), after which a following block can supply attributes such as `src` or `onload` that the filter never saw; the CVSS 4.0 vector indicates network reachability with no privileges required (PR:N) and passive user interaction (UI:P), and the upstream GitHub advisory publishes full reproduction steps, though there is no CISA KEV listing or other indication of active exploitation at time of analysis. Affected deployments are those running the library with the default `html_input=allow` and the GFM/DisallowedRawHtml extension enabled, which is the default for `GithubFlavoredMarkdownConverter`.
Malformed UTF-8 in a filename can bypass the control-character check performed by Flysystem's default WhitespacePathNormalizer before version 3.35.3, letting a filename containing ANSI escape sequences survive normalization and be stored via Filesystem::write(). When an administrator later renders Filesystem::listContents() output in an ANSI-interpreting terminal, those sequences can hide or spoof entries in the listing, giving a malicious write-capable user (PR:L) a terminal-output deception primitive with UI:R. The issue is confined to spoofed or hidden directory listings - there is no code execution, no data disclosure, and no integrity impact beyond the stored filename itself; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation, and the CVSS 3.5 score reflects the low overall risk.
Quadratic memory and output amplification in league/commonmark's XmlRenderer affects all 2.x releases from 2.0.0 through at least 2.8.x, enabling remote unauthenticated denial of service against PHP applications that convert untrusted Markdown to XML. The renderer emits depth-proportional indentation for every XML tag, causing O(n²) byte growth in both output size and memory allocation for deeply nested structures - reachable with as little as a single line of nested blockquotes. No public exploit has been identified at time of analysis, and exploitation is limited to applications using the opt-in XmlRenderer or MarkdownToXmlConverter code path.
Cross-site scripting in league/commonmark 2.7.0-2.9.0 allows unauthenticated attackers to inject arbitrary JavaScript into rendered HTML output by prefixing an attribute name with a U+000C form feed byte, bypassing the AttributesExtension's event-handler filter and the allow_unsafe_links safeguard. The bypass exploits a mismatch between what PHP's built-in trim() considers whitespace (excluding U+000C) and what PCRE \s matches (including U+000C), leaving the byte embedded in the attribute name where PHP's string comparison logic fails to recognize it but browsers' HTML parsers strip it and treat the remainder as a genuine event handler. Exploitation requires the AttributesExtension to be enabled and untrusted Markdown to be fed to the converter; no public exploit has been identified at time of analysis, though the GHSA advisory provides a precise technical breakdown sufficient to reproduce the issue.
The DisallowedRawHtml extension in PHP Commonmark (league/commonmark) versions prior to 2.8.1 can be bypassed by injecting whitespace characters between HTML tag names and closing brackets, allowing malicious scripts to pass sanitization filters and execute in user browsers. Applications relying solely on this extension to sanitize untrusted markdown input are vulnerable to cross-site scripting attacks, though those using additional HTML sanitizers are unaffected. No patch is currently available for affected versions.
league/oauth2-server is an implementation of an OAuth 2.0 authorization server written in PHP. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Flysystem is an open source file storage library for PHP. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required.
Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library before 0.18.3 allows remote attackers to insert unsafe links into HTML by using double-encoded HTML entities that are not. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library versions 0.15.6 through 0.18.x before 0.18.1 allows remote attackers to insert unsafe URLs into HTML (even if. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.