CVE-2019-10010 Moderate severity vulnerability that affects league/commonmark

What is CVE-2019-10010?

CVE-2019-10010 is a medium-severity cross-site scripting vulnerability in n/a, published on 24 Mar 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library before 0.18.3 allows remote attackers to insert unsafe links into HTML by using double-encoded HTML entities that are not properly escaped during rendering, a different vulnerability than CVE-2018-20583.

Weakness: CWE-79

Which versions are affected by CVE-2019-10010?

2 open source packages ship an affected version, including league/commonmark. It affects 1 product.

Products include Thephpleague Commonmark.

How do I fix CVE-2019-10010?

Upgrade league/commonmark to 0.18.3 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2019-10010 being exploited?

There is no known exploitation of CVE-2019-10010 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2026-86428 commonmark 1.5.0 before 2.10.0 Denial of Service via Attributes High 8.7
• CVE-2026-86429 commonmark before 2.9.1 Denial of Service via SmartPunct and Attributes High 8.7
• CVE-2026-86430 league/commonmark before 2.9.1 Denial of Service via parsing High 8.7
• CVE-2026-86431 commonmark before 2.9.1 XSS via AttributesExtension form feed bypass Medium 6.9
• CVE-2026-33347 league/commonmark has an embed extension allowed_domains bypass Medium 6.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3v43-877x-qgmq.