Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-2wss-jpkk-pbb3
Vulnerability ID VCID-2wss-jpkk-pbb3
Aliases CVE-2024-22051
GHSA-fmx4-26r3-wxpf
GMS-2022-240
Summary CommonMarker versions prior to 0.23.4 are at risk of an integer overflow vulnerability. This vulnerability can result in possibly unauthenticated remote attackers to cause heap memory corruption, potentially leading to an information leak or remote code execution, via parsing tables with marker rows that contain more than UINT16_MAX columns.
Status Published
Exploitability 0.5
Weighted Severity 8.8
Risk 4.4
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-190 Integer Overflow or Wraparound
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-22051.json
epss 0.12055 https://api.first.org/data/v1/epss?cve=CVE-2024-22051
epss 0.12055 https://api.first.org/data/v1/epss?cve=CVE-2024-22051
cvssv3.1 9.8 https://github.com/advisories/GHSA-fmx4-26r3-wxpf
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-fmx4-26r3-wxpf
ssvc Track https://github.com/advisories/GHSA-fmx4-26r3-wxpf
cvssv3.1 8.8 https://github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4x
cvssv3.1 9.8 https://github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4x
generic_textual HIGH https://github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4x
ssvc Track https://github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4x
cvssv3.1 8.8 https://github.com/gjtorikian/commonmarker
generic_textual HIGH https://github.com/gjtorikian/commonmarker
cvssv3.1 8.8 https://github.com/gjtorikian/commonmarker/commit/ab4504fd17460627a6ab255bc3c63e8e5fc6aed3
cvssv3.1 9.8 https://github.com/gjtorikian/commonmarker/commit/ab4504fd17460627a6ab255bc3c63e8e5fc6aed3
generic_textual HIGH https://github.com/gjtorikian/commonmarker/commit/ab4504fd17460627a6ab255bc3c63e8e5fc6aed3
ssvc Track https://github.com/gjtorikian/commonmarker/commit/ab4504fd17460627a6ab255bc3c63e8e5fc6aed3
cvssv3 9.8 https://github.com/gjtorikian/commonmarker/security/advisories/GHSA-fmx4-26r3-wxpf
cvssv3.1 8.8 https://github.com/gjtorikian/commonmarker/security/advisories/GHSA-fmx4-26r3-wxpf
cvssv3.1 9.8 https://github.com/gjtorikian/commonmarker/security/advisories/GHSA-fmx4-26r3-wxpf
cvssv3.1_qr HIGH https://github.com/gjtorikian/commonmarker/security/advisories/GHSA-fmx4-26r3-wxpf
generic_textual HIGH https://github.com/gjtorikian/commonmarker/security/advisories/GHSA-fmx4-26r3-wxpf
ssvc Track https://github.com/gjtorikian/commonmarker/security/advisories/GHSA-fmx4-26r3-wxpf
cvssv3.1 8.8 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/commonmarker/CVE-2024-22051.yml
generic_textual HIGH https://github.com/rubysec/ruby-advisory-db/blob/master/gems/commonmarker/CVE-2024-22051.yml
cvssv3.1 8.8 https://nvd.nist.gov/vuln/detail/CVE-2024-22051
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2024-22051
cvssv3.1 9.8 https://vulncheck.com/advisories/vc-advisory-GHSA-fmx4-26r3-wxpf
ssvc Track https://vulncheck.com/advisories/vc-advisory-GHSA-fmx4-26r3-wxpf
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-22051.json
https://api.first.org/data/v1/epss?cve=CVE-2024-22051
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22051
https://github.com/gjtorikian/commonmarker
2256887 https://bugzilla.redhat.com/show_bug.cgi?id=2256887
ab4504fd17460627a6ab255bc3c63e8e5fc6aed3 https://github.com/gjtorikian/commonmarker/commit/ab4504fd17460627a6ab255bc3c63e8e5fc6aed3
CVE-2024-22051 https://nvd.nist.gov/vuln/detail/CVE-2024-22051
CVE-2024-22051.YML https://github.com/rubysec/ruby-advisory-db/blob/master/gems/commonmarker/CVE-2024-22051.yml
GHSA-fmx4-26r3-wxpf https://github.com/advisories/GHSA-fmx4-26r3-wxpf
GHSA-fmx4-26r3-wxpf https://github.com/gjtorikian/commonmarker/security/advisories/GHSA-fmx4-26r3-wxpf
GHSA-mc3g-88wq-6f4x https://github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4x
vc-advisory-GHSA-fmx4-26r3-wxpf https://vulncheck.com/advisories/vc-advisory-GHSA-fmx4-26r3-wxpf
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-22051.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/advisories/GHSA-fmx4-26r3-wxpf
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-01-08T18:15:45Z/ Found at https://github.com/advisories/GHSA-fmx4-26r3-wxpf
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4x
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4x
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-01-08T18:15:45Z/ Found at https://github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4x
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/gjtorikian/commonmarker
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/gjtorikian/commonmarker/commit/ab4504fd17460627a6ab255bc3c63e8e5fc6aed3
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/gjtorikian/commonmarker/commit/ab4504fd17460627a6ab255bc3c63e8e5fc6aed3
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-01-08T18:15:45Z/ Found at https://github.com/gjtorikian/commonmarker/commit/ab4504fd17460627a6ab255bc3c63e8e5fc6aed3
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/gjtorikian/commonmarker/security/advisories/GHSA-fmx4-26r3-wxpf
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/gjtorikian/commonmarker/security/advisories/GHSA-fmx4-26r3-wxpf
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-01-08T18:15:45Z/ Found at https://github.com/gjtorikian/commonmarker/security/advisories/GHSA-fmx4-26r3-wxpf
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/rubysec/ruby-advisory-db/blob/master/gems/commonmarker/CVE-2024-22051.yml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2024-22051
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://vulncheck.com/advisories/vc-advisory-GHSA-fmx4-26r3-wxpf
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-01-08T18:15:45Z/ Found at https://vulncheck.com/advisories/vc-advisory-GHSA-fmx4-26r3-wxpf
Exploit Prediction Scoring System (EPSS)
Percentile 0.93949
EPSS Score 0.12055
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-10T18:47:37.302830+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2024/22xxx/CVE-2024-22051.json 38.6.0