Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:gem/commonmarker@0.23.4
purl pkg:gem/commonmarker@0.23.4
Next non-vulnerable version 0.23.10
Latest non-vulnerable version 1.0.0.pre
Risk 3.1
Vulnerabilities affecting this package (3)
Vulnerability Summary Fixed by
VCID-43xy-vnf8-kkbj
Aliases:
GHSA-4qw4-jpp4-8gvp
Unbounded resource exhaustion in cmark-gfm autolink extension may lead to denial of service ### Impact CommonMarker uses `cmark-gfm` for rendering [Github Flavored Markdown](https://github.github.com/gfm/). A polynomial time complexity issue in cmark-gfm's autolink extension may lead to unbounded resource exhaustion and subsequent denial of service. ### Patches This vulnerability has been patched in the following CommonMarker release: - v0.23.6 ### Workarounds Disable use of the autolink extension. ### References https://en.wikipedia.org/wiki/Time_complexity
0.23.6
Affected by 2 other vulnerabilities.
VCID-9q5d-95ws-2uhh
Aliases:
GHSA-7vh7-fw88-wj87
GMS-2023-1914
Several quadratic complexity bugs may lead to denial of service in Commonmarker ## Impact Several quadratic complexity bugs in commonmarker's underlying [`cmark-gfm`](https://github.com/github/cmark-gfm) library may lead to unbounded resource exhaustion and subsequent denial of service. The following vulnerabilities were addressed: * [CVE-2023-37463](https://github.com/github/cmark-gfm/security/advisories/GHSA-w4qg-3vf7-m9x5) For more information, consult the release notes for version [`0.29.0.gfm.12`](https://github.com/github/cmark-gfm/releases/tag/0.29.0.gfm.12). ## Mitigation Users are advised to upgrade to commonmarker version [`0.23.10`](https://rubygems.org/gems/commonmarker/versions/0.23.10).
0.23.10
Affected by 0 other vulnerabilities.
VCID-ryey-1gks-fydw
Aliases:
GHSA-636f-xm5j-pj9m
GMS-2023-123
Several quadratic complexity bugs may lead to denial of service in Commonmarker ## Impact Several quadratic complexity bugs in commonmarker's underlying [`cmark-gfm`](https://github.com/github/cmark-gfm) library may lead to unbounded resource exhaustion and subsequent denial of service. The following vulnerabilities were addressed: * [CVE-2023-22483](https://github.com/github/cmark-gfm/security/advisories/GHSA-29g3-96g3-jg6c) * [CVE-2023-22484](https://github.com/github/cmark-gfm/security/advisories/GHSA-24f7-9frr-5h2r) * [CVE-2023-22485](https://github.com/github/cmark-gfm/security/advisories/GHSA-c944-cv5f-hpvr) * [CVE-2023-22486](https://github.com/github/cmark-gfm/security/advisories/GHSA-r572-jvj2-3m8p) For more information, consult the release notes for version [`0.23.0.gfm.7`](https://github.com/github/cmark-gfm/releases/tag/0.29.0.gfm.7). ## Mitigation Users are advised to upgrade to commonmarker version [`0.23.7`](https://rubygems.org/gems/commonmarker/versions/0.23.7).
0.23.7
Affected by 1 other vulnerability.
1.0.0.pre
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-ph5n-2d4n-mfd3 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in commonmarker. CVE-2024-22051
GHSA-fmx4-26r3-wxpf
GMS-2022-240

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-04T18:14:19.633412+00:00 Ruby Importer Affected by VCID-9q5d-95ws-2uhh https://github.com/rubysec/ruby-advisory-db/blob/master/gems/commonmarker/GHSA-7vh7-fw88-wj87.yml 38.6.0
2026-06-04T18:14:00.093118+00:00 Ruby Importer Affected by VCID-ryey-1gks-fydw https://github.com/rubysec/ruby-advisory-db/blob/master/gems/commonmarker/GHSA-636f-xm5j-pj9m.yml 38.6.0
2026-06-04T18:13:42.997935+00:00 Ruby Importer Affected by VCID-43xy-vnf8-kkbj https://github.com/rubysec/ruby-advisory-db/blob/master/gems/commonmarker/GHSA-4qw4-jpp4-8gvp.yml 38.6.0
2026-06-04T17:52:13.792283+00:00 GithubOSV Importer Fixing VCID-ph5n-2d4n-mfd3 https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/03/GHSA-fmx4-26r3-wxpf/GHSA-fmx4-26r3-wxpf.json 38.6.0
2026-06-02T04:41:42.654846+00:00 GitLab Importer Fixing VCID-ph5n-2d4n-mfd3 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/commonmarker/GMS-2022-240.yml 38.6.0