league/commonmark has an embed extension allowed_domains bypass
Impact
The DomainFilteringAdapter in the Embed extension is vulnerable to an allowlist bypass due to a missing hostname boundary assertion in the domain-matching regex. An attacker-controlled domain like youtube.com.evil passes the allowlist check when youtube.com is an allowed domain.
This enables two attack vectors:
- SSRF: The
OscaroteroEmbedAdaptermakes server-side HTTP requests to the embed URL via theembed/embedlibrary. A bypassed domain filter causes the server to make outbound requests to an attacker-controlled host, potentially probing internal services or exfiltrating request metadata. - XSS:
EmbedRendereroutputs the oEmbed response HTML directly into the page with no sanitization. An attacker controlling the bypassed domain can return arbitrary HTML/JavaScript in their oEmbed response, which is rendered verbatim.
Any application using the Embed extension and relying on allowed_domains to restrict domains when processing untrusted Markdown input is affected.
Patches
This has been patched in version 2.8.2. The fix replaces the regex-based domain check with explicit hostname parsing using parse_url(), ensuring exact domain and subdomain matching only.
Workarounds
- Disable the
Embedextension, or restrict its use to trusted users - Provide your own domain-filtering implementation of
EmbedAdapterInterface - Enable a Content Security Policy (CSP) and outbound firewall restrictions
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | league/commonmark | >= 2.3.0, < 2.8.2 | 2.8.2 |
References
- https://github.com/thephpleague/commonmark/security/advisories/GHSA-hh8v-hgvp-g3f5
- https://nvd.nist.gov/vuln/detail/CVE-2026-33347
- https://github.com/thephpleague/commonmark/commit/59fb075d2101740c337c7216e3f32b36c204218b
- https://github.com/thephpleague/commonmark
- https://github.com/thephpleague/commonmark/releases/tag/2.8.2
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N- Weakness (CWE)
CWE-185, CWE-79, CWE-918- Platform
- Composer
- Package
league/commonmark- Disclosed
- 19.03.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-hh8v-hgvp-g3f5 - CC BY 4.0
Vulnerability history: league/commonmark
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 18
- First → latest
- 09.2019 09.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 10
- Medium 8
Disclosures per year
- 2019: 1
- 2020: 0
- 2021: 0
- 2022: 1
- 2023: 0
- 2024: 1
- 2025: 1
- 2026: 14
-
league/commonmark has an embed extension allowed_domains bypass this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.