CPE
CommonMark versions 1.5.0 through 2.09.0 are susceptible to a CPU-exhaustion denial-of-service attack due to inefficient attribute processing within the AttributesExtension.