CVE-2018-20583 PHP League CommonMark vulnerable to Cross-Site Scripting (XSS)

What is CVE-2018-20583?

CVE-2018-20583 is a medium-severity cross-site scripting vulnerability in n/a, published on 30 Dec 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library versions 0.15.6 through 0.18.x before 0.18.1 allows remote attackers to insert unsafe URLs into HTML (even if allow_unsafe_links is false) via a newline character (e.g., writing javascript as javascri%0apt).

Weakness: CWE-79

Which versions are affected by CVE-2018-20583?

2 open source packages ship an affected version, including league/commonmark. It affects 1 product.

Products include Thephpleague Commonmark.

How do I fix CVE-2018-20583?

Upgrade league/commonmark to 0.18.1 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2018-20583 being exploited?

There is no known exploitation of CVE-2018-20583 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2026-86428 commonmark 1.5.0 before 2.10.0 Denial of Service via Attributes High 8.7
• CVE-2026-86429 commonmark before 2.9.1 Denial of Service via SmartPunct and Attributes High 8.7
• CVE-2026-86430 league/commonmark before 2.9.1 Denial of Service via parsing High 8.7
• CVE-2026-86431 commonmark before 2.9.1 XSS via AttributesExtension form feed bypass Medium 6.9
• CVE-2026-33347 league/commonmark has an embed extension allowed_domains bypass Medium 6.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-qx76-c53f-5c7q.