league/commonmark is vulnerable to Denial of Service (DoS)
75
High Risk
The GitHub Flavored Markdown Table extension's block start parser reads the entire accumulated paragraph buffer and uses strpos to search for a pipe character on every non-blank line while a paragraph is open. For a paragraph of M lines with no pipes, this searches roughly k lines of buffer on line k, giving O(M^2) total work that grows with the size of the submitted Markdown. Rendering a single large paragraph of lines with no pipes through GithubFlavoredMarkdownConverter, or any environment with the Table extension enabled, uses CPU time that scales quadratically with body size and can exhaust worker processes. The fix checks only the current line for a delimiter row before using the paragraph buffer, removing the per line rescan.
You are affected if you are using a version that falls within the vulnerable range and you enable the Table extension, included by default in GithubFlavoredMarkdownConverter, to render Markdown from untrusted sources.
league/commonmark is vulnerable to Denial of Service (DoS) in versions 1.1.0 - 2.10.1.
Upgrade the league/commonmark library to the patch version.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.