CyberRota Analysis
AI-GeneratedThe league/commonmark library versions 1.5.0 to 2.9.0 are vulnerable to a denial-of-service attack due to quadratic parsing complexity in the SmartPunctExtension and AttributesExtension when these are explicitly registered. An unauthenticated attacker can exploit this vulnerability by submitting crafted Markdown documents, leading to excessive CPU consumption. Organizations using affected versions of GitHub that utilize these extensions should prioritize upgrading to version 2.9.1 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The league/commonmark (thephpleague/commonmark) library in versions >= 1.5.0 and < 2.9.1 contains quadratic parsing complexity in its SmartPunctExtension and AttributesExtension. When either extension is explicitly registered on the Environment (they are not enabled by default and are excluded from the standard CommonMark and GitHub-Flavored Markdown converters), an unauthenticated attacker can submit small, specially crafted Markdown documents — such as text alternating with unpaired quotes, contiguous runs of block-level attribute blocks, or repeated class attributes — to trigger disproportionate CPU consumption and cause a denial of service. Fixed in 2.9.1.
Related CVEs
Other vulnerabilities affecting the same vendor(s)