Skip to content
Threat Feed
Subscribe

CPE

Cpe:2.3:a:thephpleague:commonmark:*:*:*:*:*:*:*:*

2 briefs RSS
medium threat

Polynomial Time Complexity Denial of Service in league/commonmark

The league/commonmark package versions prior to 2.6.0 contain a polynomial time complexity vulnerability allowing unauthenticated attackers to cause denial-of-service via crafted Markdown inputs.

exploited commonmark
1t 1c
high advisory

Stored XSS via Attribute Filter Bypass in league/commonmark

An XSS vulnerability in league/commonmark allows attackers to execute arbitrary JavaScript by prepending a U+000C form feed character to malicious attribute names, bypassing security filters in the AttributesExtension.

commonmark +1 xss web-vulnerability php supply-chain denial-of-service algorithmic-complexity
3t 1c updated