league has 12 CVEs on record. Disclosure cadence is accelerating: 12 in the last 90 days against 0 in the 90 before. The busiest recent month was August 2026 with 6. The median CVSS is 7.5 (high). None have a confirmed exploitation report. The dominant weakness classes are CWE-407 (8) and CWE-1050 (4).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.5
- Publish → KEV
- —
- Last 90 days
- 12 prev 0
Weakness classes
Products
- league/commonmark 12
Worst active — by depth score
GHSA-3q6v-r5mr-hxv8High· 7.5league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan41GHSA-jjv6-8j6v-6j52High· 7.5league/commonmark: Denial of service in the SmartPunct and Attributes extensions41GHSA-j8pm-gj4c-rq4xHigh· 7.5league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters41GHSA-8rr7-cvq3-gmfhHigh· 7.5league/commonmark: Denial of service via distinctly-named attributes in the Attributes extension41GHSA-mh25-x5hq-wrqpHigh· 7.5league/commonmark: Denial of service via colliding heading slugs41
league vulnerabilities
CVEs affecting league, newest first. Open any entry for full detail, references, and exploit status.
12 CVEsRSS
GHSA-3q6v-r5mr-hxv8High· 7.5league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan
league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan
GHSA-97jj-33gv-5xf9Medium· 6.1league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal
league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal
GHSA-j8pm-gj4c-rq4xHigh· 7.5league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters
league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters
GHSA-f8fg-pg57-v4j8High· 7.2league/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a U+000C form feed
league/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a U+000C form feed
GHSA-jjv6-8j6v-6j52High· 7.5league/commonmark: Denial of service in the SmartPunct and Attributes extensions
league/commonmark: Denial of service in the SmartPunct and Attributes extensions
GHSA-8rr7-cvq3-gmfhHigh· 7.5league/commonmark: Denial of service via distinctly-named attributes in the Attributes extension
league/commonmark: Denial of service via distinctly-named attributes in the Attributes extension
CVE-2026-71478Medium· 6.1league/commonmark is a PHP library for parsing and rendering CommonMark Markdown
league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 1.5.0 until 2.9.0, the AttributesExtension's href and src unsafe-link filter can be bypassed by embedding control bytes, such as a tab, carriage retur…
CVE-2026-71488High· 7.5league/commonmark is a PHP library for parsing and rendering CommonMark Markdown
league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially crafted Markdown lines can cause the parser to have quadratic time complexity when converting, because several parsing pa…
GHSA-g2gp-3wwq-f4phHigh· 7.5league/commonmark: Denial of service via adjacent inline attribute blocks
league/commonmark: Denial of service via adjacent inline attribute blocks
GHSA-jfm3-95jq-q3rfHigh· 7.5league/commonmark: Denial of service via duplicate footnote definitions
league/commonmark: Denial of service via duplicate footnote definitions
GHSA-mh25-x5hq-wrqpHigh· 7.5league/commonmark: Denial of service via colliding heading slugs
league/commonmark: Denial of service via colliding heading slugs
GHSA-mj63-m3rc-8pprMedium· 5.3league/commonmark: Denial of service via deeply nested XML output
league/commonmark: Denial of service via deeply nested XML output