Search for packages
| purl | pkg:gem/commonmarker@0.17.7 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-43xy-vnf8-kkbj
Aliases: GHSA-4qw4-jpp4-8gvp |
Unbounded resource exhaustion in cmark-gfm autolink extension may lead to denial of service ### Impact CommonMarker uses `cmark-gfm` for rendering [Github Flavored Markdown](https://github.github.com/gfm/). A polynomial time complexity issue in cmark-gfm's autolink extension may lead to unbounded resource exhaustion and subsequent denial of service. ### Patches This vulnerability has been patched in the following CommonMarker release: - v0.23.6 ### Workarounds Disable use of the autolink extension. ### References https://en.wikipedia.org/wiki/Time_complexity |
Affected by 2 other vulnerabilities. |
|
VCID-9q5d-95ws-2uhh
Aliases: GHSA-7vh7-fw88-wj87 GMS-2023-1914 |
Several quadratic complexity bugs may lead to denial of service in Commonmarker ## Impact Several quadratic complexity bugs in commonmarker's underlying [`cmark-gfm`](https://github.com/github/cmark-gfm) library may lead to unbounded resource exhaustion and subsequent denial of service. The following vulnerabilities were addressed: * [CVE-2023-37463](https://github.com/github/cmark-gfm/security/advisories/GHSA-w4qg-3vf7-m9x5) For more information, consult the release notes for version [`0.29.0.gfm.12`](https://github.com/github/cmark-gfm/releases/tag/0.29.0.gfm.12). ## Mitigation Users are advised to upgrade to commonmarker version [`0.23.10`](https://rubygems.org/gems/commonmarker/versions/0.23.10). |
Affected by 0 other vulnerabilities. |
|
VCID-ph5n-2d4n-mfd3
Aliases: CVE-2024-22051 GHSA-fmx4-26r3-wxpf GMS-2022-240 |
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in commonmarker. |
Affected by 3 other vulnerabilities. |
|
VCID-ryey-1gks-fydw
Aliases: GHSA-636f-xm5j-pj9m GMS-2023-123 |
Several quadratic complexity bugs may lead to denial of service in Commonmarker ## Impact Several quadratic complexity bugs in commonmarker's underlying [`cmark-gfm`](https://github.com/github/cmark-gfm) library may lead to unbounded resource exhaustion and subsequent denial of service. The following vulnerabilities were addressed: * [CVE-2023-22483](https://github.com/github/cmark-gfm/security/advisories/GHSA-29g3-96g3-jg6c) * [CVE-2023-22484](https://github.com/github/cmark-gfm/security/advisories/GHSA-24f7-9frr-5h2r) * [CVE-2023-22485](https://github.com/github/cmark-gfm/security/advisories/GHSA-c944-cv5f-hpvr) * [CVE-2023-22486](https://github.com/github/cmark-gfm/security/advisories/GHSA-r572-jvj2-3m8p) For more information, consult the release notes for version [`0.23.0.gfm.7`](https://github.com/github/cmark-gfm/releases/tag/0.29.0.gfm.7). ## Mitigation Users are advised to upgrade to commonmarker version [`0.23.7`](https://rubygems.org/gems/commonmarker/versions/0.23.7). |
Affected by 1 other vulnerability. Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-06-04T18:14:19.587836+00:00 | Ruby Importer | Affected by | VCID-9q5d-95ws-2uhh | https://github.com/rubysec/ruby-advisory-db/blob/master/gems/commonmarker/GHSA-7vh7-fw88-wj87.yml | 38.6.0 |
| 2026-06-04T18:14:00.056298+00:00 | Ruby Importer | Affected by | VCID-ryey-1gks-fydw | https://github.com/rubysec/ruby-advisory-db/blob/master/gems/commonmarker/GHSA-636f-xm5j-pj9m.yml | 38.6.0 |
| 2026-06-04T18:13:42.954582+00:00 | Ruby Importer | Affected by | VCID-43xy-vnf8-kkbj | https://github.com/rubysec/ruby-advisory-db/blob/master/gems/commonmarker/GHSA-4qw4-jpp4-8gvp.yml | 38.6.0 |
| 2026-06-04T18:13:01.613533+00:00 | Ruby Importer | Affected by | VCID-ph5n-2d4n-mfd3 | https://github.com/rubysec/ruby-advisory-db/blob/master/gems/commonmarker/CVE-2024-22051.yml | 38.6.0 |