Количество 4
Количество 4
CVE-2026-33347
league/commonmark is a PHP Markdown parser. From version 2.3.0 to before version 2.8.2, the DomainFilteringAdapter in the Embed extension is vulnerable to an allowlist bypass due to a missing hostname boundary assertion in the domain-matching regex. An attacker-controlled domain like youtube.com.evil passes the allowlist check when youtube.com is an allowed domain. This issue has been patched in version 2.8.2.
CVE-2026-33347
league/commonmark is a PHP Markdown parser. From version 2.3.0 to before version 2.8.2, the DomainFilteringAdapter in the Embed extension is vulnerable to an allowlist bypass due to a missing hostname boundary assertion in the domain-matching regex. An attacker-controlled domain like youtube.com.evil passes the allowlist check when youtube.com is an allowed domain. This issue has been patched in version 2.8.2.
CVE-2026-33347
league/commonmark is a PHP Markdown parser. From version 2.3.0 to befo ...
GHSA-hh8v-hgvp-g3f5
league/commonmark has an embed extension allowed_domains bypass
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2026-33347 league/commonmark is a PHP Markdown parser. From version 2.3.0 to before version 2.8.2, the DomainFilteringAdapter in the Embed extension is vulnerable to an allowlist bypass due to a missing hostname boundary assertion in the domain-matching regex. An attacker-controlled domain like youtube.com.evil passes the allowlist check when youtube.com is an allowed domain. This issue has been patched in version 2.8.2. | CVSS3: 6.1 | 0% Низкий | 5 месяцев назад |
 | CVE-2026-33347 league/commonmark is a PHP Markdown parser. From version 2.3.0 to before version 2.8.2, the DomainFilteringAdapter in the Embed extension is vulnerable to an allowlist bypass due to a missing hostname boundary assertion in the domain-matching regex. An attacker-controlled domain like youtube.com.evil passes the allowlist check when youtube.com is an allowed domain. This issue has been patched in version 2.8.2. | CVSS3: 6.1 | 0% Низкий | 5 месяцев назад |
| CVE-2026-33347 league/commonmark is a PHP Markdown parser. From version 2.3.0 to befo ... | CVSS3: 6.1 | 0% Низкий | 5 месяцев назад |
| GHSA-hh8v-hgvp-g3f5 league/commonmark has an embed extension allowed_domains bypass | 0% Низкий | 5 месяцев назад |
Уязвимостей на страницу