PatchClock

PHP security digest · Packages

league/commonmark security advisories

2 advisories we have followed since September 2026, 1 of them critical or high, newest first. Each page says who is affected, which versions fix it and how to check your project.

  1. Medium 30 Sep 2026

    league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal

    Fixed in 2.10.2 · CVE-2026-105829

  2. High 30 Sep 2026

    league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan

    Fixed in 2.10.2 · CVE-2026-105830

Check your project in one command

Composer compares your composer.lock with the public advisory databases:

composer audit

It lists every installed package with a known advisory, including league/commonmark, and the version that fixes it.