CVE-2026-33347 league/commonmark has an embed extension allowed_domains bypass

What is CVE-2026-33347?

CVE-2026-33347 is a medium-severity vulnerability in thephpleague commonmark, published on 24 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

league/commonmark is a PHP Markdown parser. From version 2.3.0 to before version 2.8.2, the DomainFilteringAdapter in the Embed extension is vulnerable to an allowlist bypass due to a missing hostname boundary assertion in the domain-matching regex. An attacker-controlled domain like youtube.com.evil passes the allowlist check when youtube.com is an allowed domain. This issue has been patched in version 2.8.2.

Weakness: CWE-918, CWE-79, CWE-185

Which versions are affected by CVE-2026-33347?

2 open source packages ship an affected version, including league/commonmark. It affects 1 product.

Products include Thephpleague Commonmark.

How do I fix CVE-2026-33347?

Upgrade league/commonmark to 2.8.2 or later.

Is CVE-2026-33347 being exploited?

There is no known exploitation of CVE-2026-33347 in the wild and no public exploit code.

Other vulnerabilities in thephpleague commonmark

• CVE-2026-86428 commonmark 1.5.0 before 2.10.0 Denial of Service via Attributes High 8.7
• CVE-2026-86429 commonmark before 2.9.1 Denial of Service via SmartPunct and Attributes High 8.7
• CVE-2026-86430 league/commonmark before 2.9.1 Denial of Service via parsing High 8.7
• CVE-2026-86431 commonmark before 2.9.1 XSS via AttributesExtension form feed bypass Medium 6.9
• CVE-2019-10010 Moderate severity vulnerability that affects league/commonmark Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-33347, GHSA-hh8v-hgvp-g3f5, UBUNTU-CVE-2026-33347.