{"action":"Upgrade league/commonmark to 2.9.0 or later.","affected":[{"fixed":"2.9.0","introduced":"1.5.0"}],"component":"league/commonmark","cve_ids":[],"ecosystem":"Packagist","exploited":false,"fixed_versions":["2.9.0"],"ghsa_id":"GHSA-g2gp-3wwq-f4ph","id":"tcs_01M5KF26D4TNQX8HH8HJ7DXT2P","modified_at":"2026-08-06T20:45:15.558862305Z","published_at":"2026-08-06T20:39:52Z","references":["https://osv.dev/vulnerability/GHSA-g2gp-3wwq-f4ph","https://github.com/thephpleague/commonmark/security/advisories/GHSA-g2gp-3wwq-f4ph","https://github.com/thephpleague/commonmark/commit/2d4c0fafa62501be919262064cffa6d71687430b","https://github.com/thephpleague/commonmark","https://github.com/thephpleague/commonmark/releases/tag/2.9.0"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-g2gp-3wwq-f4ph","url":"https://osv.dev/vulnerability/GHSA-g2gp-3wwq-f4ph"}],"summary":"league/commonmark: Denial of service via adjacent inline attribute blocks"}