CVE-2026-33347
Medium
Description
league/commonmark is a PHP Markdown parser. From version 2.3.0 to before version 2.8.2, the DomainFilteringAdapter in the Embed extension is vulnerable to an allowlist bypass due to a missing hostname boundary assertion in the domain-matching regex. An attacker-controlled domain like youtube.com.evil passes the allowlist check when youtube.com is an allowed domain. This issue has been patched in version 2.8.2.
SeverityMedium
CVSS6.1
Exploit probability—
ProductThephpleague Commonmark
PublishedMar 24, 2026
First seenMar 24, 2026
How to fix
Update
- thephpleague commonmark2.8.2 or later
- league/commonmark2.8.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| thephpleague commonmark | 2.3.0 ≤ v < 2.8.2 | 2.8.2 |
| league/commonmarkPackagist | 2.3.0 ≤ v < 2.8.2 | 2.8.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.