Skip to content
Threat Feed
Subscribe

Vendor

Thephpleague

3 briefs RSS
medium advisory

Quadratic Time Denial of Service in league/commonmark Table Extension

An unauthenticated remote attacker can cause denial of service by submitting large Markdown paragraphs that trigger O(M^2) CPU consumption in the league/commonmark TableStartParser.

commonmark
1t
medium threat

Polynomial Time Complexity Denial of Service in league/commonmark

The league/commonmark package versions prior to 2.6.0 contain a polynomial time complexity vulnerability allowing unauthenticated attackers to cause denial-of-service via crafted Markdown inputs.

exploited commonmark
1t 1c
high advisory

Stored XSS via Attribute Filter Bypass in league/commonmark

An XSS vulnerability in league/commonmark allows attackers to execute arbitrary JavaScript by prepending a U+000C form feed character to malicious attribute names, bypassing security filters in the AttributesExtension.

commonmark +1 xss web-vulnerability php supply-chain denial-of-service algorithmic-complexity
3t 1c updated