PHP League CommonMark vulnerable to Cross-Site Scripting (XSS)

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2018-20583 · ADVISORY
• thephpleague/commonmark · WEB
• commonmark.thephpleague.com/changelog · WEB
• FriendsOfPHP/security-advisories · WEB
• thephpleague/commonmark · PACKAGE
• thephpleague/commonmark release 0.18.1 · WEB
• commonmark.thephpleague.com/changelog · Release Notes

league/commonmark のその他の脆弱性

• CVE-2026-105830高 7.5league/commonmark from 2.0.0 before 2.10.2 contains a quadratic-time denial of service vulnerability in the GitHub Flavored Markdown Table e…
• CVE-2026-105829中 6.1League CommonMark from 1.3.0 before 2.10.2 contains a cross-site scripting vulnerability that allows users posting Markdown to bypass the Di…
• CVE-2024-58382高 7.5league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause…
• CVE-2026-86434高 7.5league/commonmark versions >= 2.0.0 and < 2.8.4 (patched in 2.9.0) contain a denial of service vulnerability in UniqueSlugNormalizer::normal…
• CVE-2026-86431高 7.2league/commonmark (thephpleague/commonmark) versions >= 2.7.0 and < 2.9.1 contain a cross-site scripting vulnerability in the AttributesExte…