{"answers":{"affected":"2 open source packages ship an affected version, including league/commonmark.","exploited":"There is no known exploitation of GHSA-g2gp-3wwq-f4ph in the wild and no public exploit code.","fix":"Upgrade league/commonmark to 2.9.0 or later.","what":"GHSA-g2gp-3wwq-f4ph is a denial of service vulnerability in league/commonmark, published on 6 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-g2gp-3wwq-f4ph and fix it if it is affected.\n\nWhat it is: GHSA-g2gp-3wwq-f4ph is a denial of service vulnerability in league/commonmark, published on 6 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-g2gp-3wwq-f4ph in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- league/commonmark (Packagist): affected from 1.5.0; fixed in 2.9.0\n- league/commonmark (Packagist): affected from 1.5.0; fixed in 2.9.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-g2gp-3wwq-f4ph/ (Markdown: https://insights.sbomify.com/GHSA-g2gp-3wwq-f4ph/index.md)","id":"GHSA-g2gp-3wwq-f4ph","markdown":"https://insights.sbomify.com/GHSA-g2gp-3wwq-f4ph/index.md","name":"GHSA-g2gp-3wwq-f4ph","record":{"aliases":[],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":true,"product_category":"PHP Markdown library","requires_auth":"none","summary":"An unauthenticated attacker can cause denial of service via quadratic time complexity in the Attributes extension of the league/commonmark library.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Impact\n\nWith the Attributes extension enabled, `AttributesListener::findTargetAndDirection()` resolves each attribute node's target by walking outward through its siblings. For a run of N adjacent inline attribute blocks placed at the start of a block (with nothing to their left), each node scans the **entire** sibling list to the far-right end before giving up and falling back to the parent. Each resolution is therefore Θ(N) and the whole run is **Θ(N²)**.\n\nReaching the path requires `AttributesExtension` (opt-in, but first-party: `League\\CommonMark\\Extension\\Attributes\\AttributesExtension`). No other configuration matters — the quadratic walk runs unconditionally during parsing and is **not** gated by the `attributes/allow` allow-list, the `on*` hardening added in 2.7.0, or `allow_unsafe_links`. An unauthenticated attacker can submit a **~32 KB** input (`{#a}` repeated 8,000 times) that takes **over 5 seconds** to convert, with time growing quadratically in input length — a cheap denial of service. Availability impact only. **The Attributes extension was introduced in 1.5.0 (May 2020) with this outward-walk resolver present from the first commit, so all releases from 1.5.0 onward (including every 2.x) are affected.**\n\n### Workarounds\n\nThere is no library-level configuration that gates the quadratic walk. Integrators who cannot upgrade can only reduce exposure indirectly:\n\n- **Disable the Attributes extension** for untrusted input, or\n- **Impose a strict maximum input length before conversion** — noting that because the cost is quadratic, even a modest cap must be small to meaningfully bound worst-case CPU.\n\nUpgrading to a release containing the fix is recommended.","ecosystems":["Packagist"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"league/commonmark: Denial of service via adjacent inline attribute blocks","id":"GHSA-g2gp-3wwq-f4ph","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"Packagist","product":null,"products":[],"type":"denial_of_service","year":"2026"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"Packagist","fixed":["2.9.0"],"introduced":["1.5.0"],"last_affected":[],"package":"league/commonmark","purl":null,"source":"GHSA-g2gp-3wwq-f4ph"},{"ecosystem":"Packagist","fixed":["2.9.0"],"introduced":["1.5.0"],"last_affected":[],"package":"league/commonmark","purl":"pkg:composer/league/commonmark","source":"GHSA-g2gp-3wwq-f4ph"}],"products":null,"published":"2026-08-06","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"An unauthenticated attacker can cause denial of service via quadratic time complexity in the Attributes extension of the league/commonmark library.","url":"https://insights.sbomify.com/GHSA-g2gp-3wwq-f4ph/"}