league/commonmark is vulnerable to Denial of Service (DoS)
75
High Risk
The AttributesExtension re-processes every attribute a node has already collected each time another attribute is applied to it, in both the inline attribute listener and the block-level continuation parser. When attributes carry distinct names, the accumulated set is rebuilt with array_merge and re-filtered on every step, so a run of distinctly-named attributes costs quadratic time. User-controlled Markdown containing long runs of adjacent inline attributes or consecutive attribute-block lines forces disproportionate CPU work from a small request, occupying PHP workers and preventing legitimate requests from completing. The fix folds each node or line into the accumulated attributes at a cost proportional to that node alone, leaving rendered output unchanged.
You are affected if you are using a version that falls within the vulnerable range and you have explicitly registered the AttributesExtension on your Environment to convert untrusted Markdown.
league/commonmark is vulnerable to Denial of Service (DoS) in versions 1.5.0 - 2.9.2.
Upgrade the league/commonmark library to the patch version.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant