CVE-2026-33347
league/commonmark has an embed extension allowed_domains bypass
league/commonmark is a PHP Markdown parser. From version 2.3.0 to before version 2.8.2, the DomainFilteringAdapter in the Embed extension is vulnerable to an allowlist bypass due to a missing hostname boundary assertion in the domain-matching regex. An attacker-controlled domain like youtube.com.evil passes the allowlist check when youtube.com is an allowed domain. This issue has been patched in version 2.8.2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
league/commonmark has an embed extension allowed_domains bypass
league/commonmark is a PHP Markdown parser. From version 2.3.0 to before version 2.8.2, the DomainFilteringAdapter in the Embed extension is vulnerable to an allowlist bypass due to a missing hostname boundary assertion in the domain-matching regex. An attacker-controlled domain like youtube.com.evil passes the allowlist check when youtube.com is an allowed domain. This issue has been patched in version 2.8.2.
- Record
CVE-2026-33347- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N - Weakness
- CWE-79, CWE-185, CWE-918
- Updated
- 2026-11-02
EUVDEUVD-2026-20079
league/commonmark is a PHP Markdown parser. From version 2.3.0 to before version 2.8.2, the DomainFilteringAdapter in the Embed extension is vulnerable to an allowlist bypass due to a missing hostname boundary assertion in the domain-matching regex. An attacker-controlled domain like youtube.com.evil passes the allowlist check when youtube.com is an allowed domain. This issue has been patched in version 2.8.2.
- Record
EUVD-2026-20079- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-hh8v-hgvp-g3f5
league/commonmark has an embed extension allowed_domains bypass
Impact
The DomainFilteringAdapter in the Embed extension is vulnerable to an allowlist bypass due to a missing hostname boundary assertion in the domain-matching regex. An attacker-controlled domain like youtube.com.evil passes the allowlist check when youtube.com is an allowed domain.
This enables two attack vectors:
- SSRF: The
OscaroteroEmbedAdaptermakes server-side HTTP requests to the embed URL via theembed/embedlibrary. A bypassed domain filter causes the server to make outbound requests to an attacker-controlled host, potentially probing internal services or exfiltrating request metadata. - XSS:
EmbedRendereroutputs the oEmbed response HTML directly into the page with no sanitization. An attacker controlling the bypassed domain can return arbitrary HTML/JavaScript in their oEmbed response, which is rendered verbatim.
Any application using the Embed extension and relying on allowed_domains to restrict domains when processing untrusted Markdown input is affected.
Patches
This has been patched in version 2.8.2. The fix replaces the regex-based domain check with explicit hostname parsing using parse_url(), ensuring exact domain and subdomain matching only.
Workarounds
- Disable the
Embedextension, or restrict its use to trusted users - Provide your own domain-filtering implementation of
EmbedAdapterInterface - Enable a Content Security Policy (CSP) and outbound firewall restrictions
- Record
GHSA-hh8v-hgvp-g3f5- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N - Weakness
- CWE-79, CWE-185, CWE-918
- Updated
- 2026-11-02
NVD
league/commonmark is a PHP Markdown parser. From version 2.3.0 to before version 2.8.2, the DomainFilteringAdapter in the Embed extension is vulnerable to an allowlist bypass due to a missing hostname boundary assertion in the domain-matching regex. An attacker-controlled domain like youtube.com.evil passes the allowlist check when youtube.com is an allowed domain. This issue has been patched in version 2.8.2.
- Record
CVE-2026-33347- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79, CWE-185, CWE-918
- Updated
- 2026-11-02
OSV
league/commonmark has an embed extension allowed_domains bypass
league/commonmark is a PHP Markdown parser. From version 2.3.0 to before version 2.8.2, the DomainFilteringAdapter in the Embed extension is vulnerable to an allowlist bypass due to a missing hostname boundary assertion in the domain-matching regex. An attacker-controlled domain like youtube.com.evil passes the allowlist check when youtube.com is an allowed domain. This issue has been patched in version 2.8.2.
- Record
CVE-2026-33347- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N - Weakness
- CWE-185, CWE-79, CWE-918
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-33347
league/commonmark is a PHP Markdown parser. From version 2.3.0 to before version 2.8.2, the DomainFilteringAdapter in the Embed extension is vulnerable to an allowlist bypass due to a missing hostname boundary assertion in the domain-matching regex. An attacker-controlled domain like youtube.com.evil passes the allowlist check when youtube.com is an allowed domain. This issue has been patched in version 2.8.2.
- Record
DEBIAN-CVE-2026-33347- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Show 4 moreShow less
OSVGHSA-hh8v-hgvp-g3f5
league/commonmark has an embed extension allowed_domains bypass
Impact
The DomainFilteringAdapter in the Embed extension is vulnerable to an allowlist bypass due to a missing hostname boundary assertion in the domain-matching regex. An attacker-controlled domain like youtube.com.evil passes the allowlist check when youtube.com is an allowed domain.
This enables two attack vectors:
- SSRF: The
OscaroteroEmbedAdaptermakes server-side HTTP requests to the embed URL via theembed/embedlibrary. A bypassed domain filter causes the server to make outbound requests to an attacker-controlled host, potentially probing internal services or exfiltrating request metadata. - XSS:
EmbedRendereroutputs the oEmbed response HTML directly into the page with no sanitization. An attacker controlling the bypassed domain can return arbitrary HTML/JavaScript in their oEmbed response, which is rendered verbatim.
Any application using the Embed extension and relying on allowed_domains to restrict domains when processing untrusted Markdown input is affected.
Patches
This has been patched in version 2.8.2. The fix replaces the regex-based domain check with explicit hostname parsing using parse_url(), ensuring exact domain and subdomain matching only.
Workarounds
- Disable the
Embedextension, or restrict its use to trusted users - Provide your own domain-filtering implementation of
EmbedAdapterInterface - Enable a Content Security Policy (CSP) and outbound firewall restrictions
- Record
GHSA-hh8v-hgvp-g3f5- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N - Weakness
- CWE-185, CWE-79, CWE-918
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-33347
league/commonmark is a PHP Markdown parser. From version 2.3.0 to before version 2.8.2, the DomainFilteringAdapter in the Embed extension is vulnerable to an allowlist bypass due to a missing hostname boundary assertion in the domain-matching regex. An attacker-controlled domain like youtube.com.evil passes the allowlist check when youtube.com is an allowed domain. This issue has been patched in version 2.8.2.
- Record
UBUNTU-CVE-2026-33347- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1776904648 No score
TuxCare security update for league/commonmark (2 CVEs)
TuxCare rebuilt league/commonmark to address 2 CVEs. Fixed in 2.7.1-p1+tuxcare.
- Record
CLSA-2026-1776904648- Updated
- 2026-11-02
OSVUSN-8194-1 No score
php-league-commonmark vulnerabilities
It was discovered that league/commonmark did not properly restrict unsafe attributes when the Attributes extension was enabled. An attacker could possibly use this issue to cause cross-site scripting by injecting malicious code into rendered HTML. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-46734)
It was discovered that league/commonmark did not properly block certain disallowed HTML tags in some cases. An attacker could possibly use this issue to cause cross-site scripting by inserting malicious HTML that bypassed filtering. (CVE-2026-30838)
It was discovered that league/commonmark did not properly enforce domain allowlist checks in the Embed extension. An attacker could possibly use this issue to bypass domain restrictions and cause untrusted content to be treated as allowed. This issue only affected Ubuntu 24.04 LTS. (CVE-2026-33347)
- Record
USN-8194-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
league/commonmarkPackagist |
2.3.0 to 2.8.1 | 2.8.2 |
league/commonmarkTuxCare:Packagist From an advisory covering 2 CVEs |
2.7.1 up to 2.7.1-p1+tuxcare | 2.7.1-p1+tuxcare |
php-league-commonmarkDebian:12 |
before 2.3.9-1+deb12u1, plus listed versions 2.3.9-1 |
2.3.9-1+deb12u1 |
php-league-commonmarkDebian:13 |
before 2.7.0-1+deb13u1, plus listed versions 2.7.0-1 |
2.7.0-1+deb13u1 |
php-league-commonmarkDebian:14 |
before 2.8.2-1, plus listed versions 2.7.0-12.7.1-12.7.1-22.8.0-12.8.1-1 |
2.8.2-1 |
league/commonmarkPackagist |
2.3.0 up to 2.8.2, plus listed versions 2.3.12.3.22.3.32.3.42.3.5 Show 20 moreShow less2.3.62.3.72.3.82.3.92.4.02.4.12.4.22.4.32.4.42.5.02.5.12.5.22.5.32.6.02.6.12.6.22.7.02.7.12.8.02.8.1 |
2.8.2 |
php-league-commonmarkUbuntu:Pro:20.04:LTS |
before 1.3.1-1ubuntu2+esm1, plus listed versions 1.1.2-11.2.0-11.3.0-11.3.1-11.3.1-1ubuntu2 |
1.3.1-1ubuntu2+esm1 |
php-league-commonmarkUbuntu:Pro:22.04:LTS |
before 1.6.7-1ubuntu0.1~esm1, plus listed versions 1.5.7-2build11.6.6-1build11.6.7-1 |
1.6.7-1ubuntu0.1~esm1 |
php-league-commonmarkUbuntu:Pro:24.04:LTS |
before 2.4.2-2ubuntu0.1~esm1, plus listed versions 2.3.9-12.4.1-12.4.2-12.4.2-2 |
2.4.2-2ubuntu0.1~esm1 |
php-league-commonmarkUbuntu:25.10 |
All versions, plus listed versions 2.6.1-22.6.2-12.7.0-1 |
None known |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
php-league-commonmarkUbuntu:26.10 |
All versions, plus listed versions 2.8.0-12.8.2-22.8.3-12.10.0-1 |
None known |
php-league-commonmarkUbuntu:26.04:LTS |
All versions, plus listed versions 2.7.0-12.7.1-22.8.0-1 |
None known |
php-league-commonmarkUbuntu:Pro:20.04:LTS From an advisory covering 3 CVEs |
before 1.3.1-1ubuntu2+esm1, plus listed versions 1.1.2-11.2.0-11.3.0-11.3.1-11.3.1-1ubuntu2 |
1.3.1-1ubuntu2+esm1 |
php-league-commonmarkUbuntu:Pro:22.04:LTS From an advisory covering 3 CVEs |
before 1.6.7-1ubuntu0.1~esm1, plus listed versions 1.5.7-2build11.6.6-1build11.6.7-1 |
1.6.7-1ubuntu0.1~esm1 |
php-league-commonmarkUbuntu:Pro:24.04:LTS From an advisory covering 3 CVEs |
before 2.4.2-2ubuntu0.1~esm1, plus listed versions 2.3.9-12.4.1-12.4.2-12.4.2-2 |
2.4.2-2ubuntu0.1~esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-33347 is a medium vulnerability (CVSS 6.3) in Thephpleague Commonmark, published March 19, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.25%, the 16th percentile. Fixed in league/commonmark 2.8.2.
References
github.com/thephpleague/commonmark/security/advisories/GHSA-hh8v-hgvp-g3f5
nvd.nist.gov/vuln/detail/CVE-2026-33347