{"action":"Upgrade league/commonmark to 2.8.2 or later.","affected":[{"fixed":"2.8.2","introduced":"2.3.0"}],"component":"league/commonmark","cve_ids":["CVE-2026-33347"],"ecosystem":"Packagist","epss":0.0025,"exploited":false,"fixed_versions":["2.8.2"],"ghsa_id":"GHSA-hh8v-hgvp-g3f5","id":"tcs_01M5KF3NC5C678RSHK7NPFM0H3","modified_at":"2026-03-27T22:16:23.526812Z","published_at":"2026-03-19T19:04:24Z","references":["https://osv.dev/vulnerability/GHSA-hh8v-hgvp-g3f5","https://github.com/thephpleague/commonmark/security/advisories/GHSA-hh8v-hgvp-g3f5","https://nvd.nist.gov/vuln/detail/CVE-2026-33347","https://github.com/thephpleague/commonmark/commit/59fb075d2101740c337c7216e3f32b36c204218b","https://github.com/thephpleague/commonmark","https://github.com/thephpleague/commonmark/releases/tag/2.8.2"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-hh8v-hgvp-g3f5","url":"https://osv.dev/vulnerability/GHSA-hh8v-hgvp-g3f5"},{"source":"nvd","source_id":"CVE-2026-33347","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33347"}],"summary":"league/commonmark has an embed extension allowed_domains bypass"}