Ubuntu alert USN-8194-1 (php-league-commonmark)

From:
             
 
noreply+usn-bot@canonical.com
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8194-1] league/commonmark vulnerabilities
Date:
             
 
Thu, 23 Apr 2026 13:53:31 +0000
Message-ID:
             
 
<E1wFuUl-00039R-U9@lists.ubuntu.com>
==========================================================================
Ubuntu Security Notice USN-8194-1
April 21, 2026

php-league-commonmark vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS

Summary:

Several security issues were fixed in league/commonmark.

Software Description:
- php-league-commonmark: Highly-extensible PHP Markdown parser which fully supports the CommonMark
and GFM specs

Details:

It was discovered that league/commonmark did not properly restrict
unsafe attributes when the Attributes extension was enabled. An attacker
could possibly use this issue to cause cross-site scripting by injecting
malicious code into rendered HTML. This issue only affected Ubuntu 22.04
LTS and Ubuntu 24.04 LTS. (CVE-2025-46734)

It was discovered that league/commonmark did not properly block certain
disallowed HTML tags in some cases. An attacker could possibly use this
issue to cause cross-site scripting by inserting malicious HTML that
bypassed filtering. (CVE-2026-30838)

It was discovered that league/commonmark did not properly enforce domain
allowlist checks in the Embed extension. An attacker could possibly use
this issue to bypass domain restrictions and cause untrusted content to
be treated as allowed. This issue only affected Ubuntu 24.04 LTS.
(CVE-2026-33347)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.04 LTS
  php-league-commonmark           2.4.2-2ubuntu0.1~esm1
                                  Available with Ubuntu Pro

Ubuntu 22.04 LTS
  php-league-commonmark           1.6.7-1ubuntu0.1~esm1
                                  Available with Ubuntu Pro

Ubuntu 20.04 LTS
  php-league-commonmark           1.3.1-1ubuntu2+esm1
                                  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8194-1
  CVE-2025-46734, CVE-2026-30838, CVE-2026-33347


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmnnyfwACgkQcpJm3tlz
hgHR+w//QgvJxvVdixh/E25HGs+CQODemnYckrdvcEqoE3T1wR1LxgY67wu3X4JC
utvB8at03ecKl2T4b+fza7wXuHZDNiccscpgnEVpucqEG8qtBy9uTBHSuQqjo4cE
JwdFgPHOAfFZ47mZ9AU7jR8Yy4j05BixeNd58vdE2IbREuwGYJ/lW/7fAtGY+d7V
wYHKanDsgGWeAoENGfMTb5eHLNnhzhi3dCVITniLo1LHs+itgkrunGOta5C/up6r
upKPZyYD19E70N6/mwe2LzWqtPtx0IpQ/HGMWlOGxwvBKY4DXmar/kTAKAs9sbz0
J3zb2zK/isowfLcYOz2lZnJQhUBeQtDpETXMZ8fpAARsHQLAaHfjcrV6Ucq9bjFX
cFxWJNFN4hG5CC1UgYSaN1pVEATxK13kh6h4dFcjs0xBcv0T2/CjUehiHOJh4utP
Cz0v2LpiOVL2GwZUBH5LFzT9zRjZJMbYx0rElCLgM72UVxMxh6BFRJIaop9Rh6EZ
dYSts47Vqhd15RWSFQ4UNgKT7R20znNGJHMqiJaf8MgJi3jmA1OUIsB8UEUWmOzr
D1eJmXGwV+Eg3u6wo8KAvkMuwzukOvkqyUfItahh2zG97BMyQZlZ3QK5aEz6cAu+
8tgd4a8CH6WS4jJF1Kaafxvk32P4vMZ5M8FKCgACA9jsK8gSPHw=
=d/8z
-----END PGP SIGNATURE-----