Packagist/league/commonmark CVE-2026-86428: high 7.5, EPSS 0.49%
league/commonmark: Denial of service via distinctly-named attributes in the Attributes extension
Action: Upgrade league/commonmark to 2.10.0 or later.
composer require league/commonmark:2.10.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.5.0 | 2.10.0 | - |
Fixed versions
| 2.10.0 |
Sources
- osv: GHSA-8rr7-cvq3-gmfh
- https://github.com/thephpleague/commonmark/security/advisories/GHSA-8rr7-cvq3-gmfh
- https://github.com/thephpleague/commonmark/commit/f27eb720972490b5af4dbb635ad8634529faf9f2
- https://github.com/thephpleague/commonmark
- https://github.com/thephpleague/commonmark/releases/tag/2.10.0
CVE-2026-86428 · published · modified · JSON