THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-jjv6-8j6v-6j52 (high) — league/commonmark: Denial of service in the SmartPunct and Attributes extensions

[GHSA] GHSA-jjv6-8j6v-6j52 (high) — league/commonmark: Denial of service in the SmartPunct and Attributes extensions

medgithub_advisoriesPublished 2026-09-01

GHSA-jjv6-8j6v-6j52 Severity: high CVE: None

league/commonmark: Denial of service in the SmartPunct and Attributes extensions

### Impact

Two first-party extensions contain quadratic parsing paths. Both ship with the library but must be explicitly registered on the `Environment`; neither is included in `CommonMarkConverter`, `GithubFlavoredMarkdownConverter`, or `GithubFlavoredMarkdownExtension`

Original source: https://github.com/advisories/GHSA-jjv6-8j6v-6j52