Inefficient Algorithmic Complexity Affecting league/commonmark package, versions >=1.5.0, <2.9.1

league/commonmark is a PHP-based Markdown parser which supports the full CommonMark spec. It is based on the CommonMark JS reference implementation.

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the AttributesListener::findTargetAndDirection() path in src/Extension/Attributes/Event/AttributesListener.php and the block-attribute merge logic in src/Extension/Attributes/Parser/AttributesBlockContinueParser.php and src/Extension/Attributes/Util/AttributesHelper.php. An attacker can exhaust CPU and stall Markdown conversion by submitting crafted input with long runs of block-level attribute nodes or repeated .class attributes. The vulnerable code repeatedly rescans sibling chains for block-level attributes and rebuilds the accumulated class list on each merge, producing quadratic parsing time. In affected applications that register the Attributes extension on untrusted Markdown, a small request can tie up PHP workers and prevent legitimate conversions from completing.

Workarounds

• Do not register AttributesExtension when converting untrusted Markdown; this removes the block-attribute scanning and class-list merge paths that can be driven into quadratic CPU use.
• If AttributesExtension is required, impose a strict maximum input length before conversion so attackers cannot supply long runs of block-level attributes or repeated .class attributes that trigger the expensive parsing path.

• GitHub Commit 2.9.1
• Maintainer's Advisory