Debian Package Tracker
Register | Log in
Subscribe

php-league-commonmark

Markdown parser based on the CommonMark JS reference implementation

Choose email to subscribe with

general
  • source: php-league-commonmark (main)
  • version: 2.7.0-1
  • maintainer: Debian PHP PEAR Maintainers (archive) (DMD)
  • uploaders: David Prévot [DMD]
  • arch: all
  • std-ver: 4.7.2
  • VCS: Git (Browse, QA)
versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]
[pool directory]
  • oldstable: 1.5.7-2
  • stable: 2.3.9-1
  • testing: 2.7.0-1
  • unstable: 2.7.0-1
versioned links
  • 1.5.7-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 2.3.9-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 2.7.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
binaries
  • php-league-commonmark
action needed
1 security issue in bullseye high

There is 1 open security issue in bullseye.

1 important issue:
  • CVE-2025-46734: league/commonmark is a PHP Markdown parser. A cross-site scripting (XSS) vulnerability in the Attributes extension of the league/commonmark library (versions 1.5.0 through 2.6.x) allows remote attackers to insert malicious JavaScript calls into HTML. The league/commonmark library provides configuration options such as `html_input: 'strip'` and `allow_unsafe_links: false` to mitigate cross-site scripting (XSS) attacks by stripping raw HTML and disallowing unsafe links. However, when the Attributes Extension is enabled, it introduces a way for users to inject arbitrary HTML attributes into elements via Markdown syntax using curly braces. Version 2.7.0 contains three changes to prevent this XSS attack vector: All attributes starting with `on` are considered unsafe and blocked by default; support for an explicit allowlist of allowed HTML attributes; and manually-added `href` and `src` attributes now respect the existing `allow_unsafe_links` configuration option. If upgrading is not feasible, please consider disabling the `AttributesExtension` for untrusted users and/or filtering the rendered HTML through a library like HTMLPurifier.
Created: 2025-05-09 Last update: 2025-05-15 00:00
1 security issue in bookworm high

There is 1 open security issue in bookworm.

1 important issue:
  • CVE-2025-46734: league/commonmark is a PHP Markdown parser. A cross-site scripting (XSS) vulnerability in the Attributes extension of the league/commonmark library (versions 1.5.0 through 2.6.x) allows remote attackers to insert malicious JavaScript calls into HTML. The league/commonmark library provides configuration options such as `html_input: 'strip'` and `allow_unsafe_links: false` to mitigate cross-site scripting (XSS) attacks by stripping raw HTML and disallowing unsafe links. However, when the Attributes Extension is enabled, it introduces a way for users to inject arbitrary HTML attributes into elements via Markdown syntax using curly braces. Version 2.7.0 contains three changes to prevent this XSS attack vector: All attributes starting with `on` are considered unsafe and blocked by default; support for an explicit allowlist of allowed HTML attributes; and manually-added `href` and `src` attributes now respect the existing `allow_unsafe_links` configuration option. If upgrading is not feasible, please consider disabling the `AttributesExtension` for untrusted users and/or filtering the rendered HTML through a library like HTMLPurifier.
Created: 2025-05-09 Last update: 2025-05-15 00:00
debian/patches: 4 patches to forward upstream low

Among the 4 debian patches available in version 2.7.0-1 of the package, we noticed the following issues:

  • 4 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.
Created: 2023-02-26 Last update: 2025-05-08 20:33
news
[rss feed]
  • [2025-05-15] php-league-commonmark 2.7.0-1 MIGRATED to testing (Debian testing watch)
  • [2025-05-08] Accepted php-league-commonmark 2.7.0-1 (source) into unstable (David Prévot)
  • [2025-05-02] php-league-commonmark 2.6.2-1 MIGRATED to testing (Debian testing watch)
  • [2025-04-22] Accepted php-league-commonmark 2.6.2-1 (source) into unstable (David Prévot)
  • [2025-03-02] php-league-commonmark 2.6.1-2 MIGRATED to testing (Debian testing watch)
  • [2025-02-24] Accepted php-league-commonmark 2.6.1-2 (source) into unstable (David Prévot)
  • [2025-01-01] php-league-commonmark 2.6.1-1 MIGRATED to testing (Debian testing watch)
  • [2024-12-30] Accepted php-league-commonmark 2.6.1-1 (source) into unstable (David Prévot)
  • [2024-12-28] php-league-commonmark 2.6.0-1 MIGRATED to testing (Debian testing watch)
  • [2024-12-26] Accepted php-league-commonmark 2.6.0-1 (source) into unstable (David Prévot)
  • [2024-08-20] php-league-commonmark 2.5.3-1 MIGRATED to testing (Debian testing watch)
  • [2024-08-18] Accepted php-league-commonmark 2.5.3-1 (source) into unstable (David Prévot)
  • [2024-07-29] php-league-commonmark 2.5.1-1 MIGRATED to testing (Debian testing watch)
  • [2024-07-27] Accepted php-league-commonmark 2.5.1-1 (source) into unstable (David Prévot)
  • [2024-07-25] php-league-commonmark 2.5.0-1 MIGRATED to testing (Debian testing watch)
  • [2024-07-23] Accepted php-league-commonmark 2.5.0-1 (source) into unstable (David Prévot)
  • [2024-03-11] php-league-commonmark 2.4.2-2 MIGRATED to testing (Debian testing watch)
  • [2024-03-05] Accepted php-league-commonmark 2.4.2-2 (source) into unstable (David Prévot)
  • [2024-02-11] php-league-commonmark 2.4.2-1 MIGRATED to testing (Debian testing watch)
  • [2024-02-07] Accepted php-league-commonmark 2.4.2-1 (source) into unstable (David Prévot)
  • [2023-09-06] php-league-commonmark 2.4.1-1 MIGRATED to testing (Debian testing watch)
  • [2023-09-04] Accepted php-league-commonmark 2.4.1-1 (source) into unstable (David Prévot)
  • [2023-03-26] Accepted php-league-commonmark 2.4.0-1 (source) into experimental (David Prévot)
  • [2023-02-26] php-league-commonmark 2.3.9-1 MIGRATED to testing (Debian testing watch)
  • [2023-02-15] Accepted php-league-commonmark 2.3.9-1 (source) into unstable (David Prévot)
  • [2022-12-14] php-league-commonmark 2.3.8-1 MIGRATED to testing (Debian testing watch)
  • [2022-12-12] Accepted php-league-commonmark 2.3.8-1 (source) into unstable (David Prévot)
  • [2022-11-09] php-league-commonmark 2.3.7-1 MIGRATED to testing (Debian testing watch)
  • [2022-11-06] Accepted php-league-commonmark 2.3.7-1 (source) into unstable (David Prévot)
  • [2022-11-05] php-league-commonmark 2.3.6-1 MIGRATED to testing (Debian testing watch)
  • 1
  • 2
bugs [bug history graph]
  • all: 0
links
  • homepage
  • lintian
  • buildd: logs, reproducibility
  • popcon
  • browse source code
  • edit tags
  • other distros
  • security tracker
  • screenshots
  • debian patches
  • debci
ubuntu Ubuntu logo [Information about Ubuntu for Debian Developers]
  • version: 2.7.0-1

Debian Package Tracker — Copyright 2013-2025 The Distro Tracker Developers
Report problems to the tracker.debian.org pseudo-package in the Debian BTS.
Documentation — Bugs — Git Repository — Contributing