AIKIDO-2026-104018
league/commonmark is vulnerable to Denial of Service (DoS)
75
High Risk
This Affects:
league/commonmarkTL;DR
With the Attributes extension enabled, the listener that resolves each inline attribute block's target walks outward through all sibling nodes before falling back to the parent. A run of adjacent inline attribute blocks placed at the start of a block makes each resolution scan the whole sibling list, giving quadratic time overall. A small untrusted document of repeated attribute markers can take seconds of CPU to convert, denying service. The fix stops the sibling walk for inline attributes that can only apply to their parent block.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you use the Attributes extension to render untrusted Markdown input.
Background info
league/commonmark is vulnerable to Denial of Service (DoS) in versions 1.5.0 - 2.8.3.
How to fix this
Upgrade the league/commonmark library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant