league/commonmark

Highly-extensible PHP Markdown parser which fully supports the CommonMark spec and GitHub-Flavored Markdown (GFM)

Latest 2.10.3

Packagist

88%

Total Score

healthy

Healthy release with strong maintenance evidence; unpinned workflow dependencies are the main caveat.

Are you affected? Scan for Free

Health Score Breakdown

Workflow audit

All three workflows were analyzed with no untrusted checkout or script-injection findings, but all 14 action references are unpinned and a high-confidence audit finding identifies an unpinned container image; this is a reproducibility and workflow-hygiene caution.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-261475 league/commonmark is vulnerable to Cross-Site Scripting (XSS) in versions 1.3.0 - 2.10.1.	1.3.0 - 2.10.1	Medium
AIKIDO-2026-785533 league/commonmark is vulnerable to Denial of Service (DoS) in versions 1.1.0 - 2.10.1.	1.1.0 - 2.10.1	High
AIKIDO-2026-550503 league/commonmark is vulnerable to Denial of Service (DoS) in versions 1.5.0 - 2.9.2.	1.5.0 - 2.9.2	High
AIKIDO-2026-280543 league/commonmark is vulnerable to Cross-Site Scripting (XSS) in versions 2.7.0 - 2.9.0.	2.7.0 - 2.9.0	High
AIKIDO-2026-319775 league/commonmark is vulnerable to Denial of Service (DoS) in versions 0.6.0 - 2.9.0.	0.6.0 - 2.9.0	High

Package versions

Maintainers

Colin O'Dell

Direct Dependencies

Dependency	Last Release	Score
league/config Version ^1.1.1	—	—
psr/event-dispatcher Version ^1.0	—	—
symfony/polyfill-php80 Version ^1.16	—	—
symfony/deprecation-contracts Version ^2.1 \|\| ^3.0	—	—