Nixpkgs security tracker
league/commonmark has an embed extension allowed_domains bypass
league/commonmark is a PHP Markdown parser. From version 2.3.0 to before version 2.8.2, the DomainFilteringAdapter in the Embed extension is vulnerable to an allowlist bypass due to a missing hostname boundary assertion in the domain-matching regex. An attacker-controlled domain like youtube.com.evil passes the allowlist check when youtube.com is an allowed domain. This issue has been patched in version 2.8.2.
References
Affected products
- ==>= 2.3.0, < 2.8.2
Matching in nixpkgs
pkgs.guile-commonmark
Implementation of CommonMark for Guile
-
nixos-unstable 2020-04-30
- nixpkgs-unstable 2020-04-30
- nixos-unstable-small 2020-04-30
-
nixos-25.11 2020-04-30
- nixos-25.11-small 2020-04-30
- nixpkgs-25.11-darwin 2020-04-30
pkgs.rubyPackages.commonmarker
None
pkgs.haskellPackages.commonmark
Pure Haskell commonmark parser
pkgs.python312Packages.commonmark
Python CommonMark parser
pkgs.python313Packages.commonmark
Python CommonMark parser
pkgs.python314Packages.commonmark
Python CommonMark parser
pkgs.rubyPackages_3_1.commonmarker
None
pkgs.rubyPackages_3_2.commonmarker
None
pkgs.rubyPackages_3_3.commonmarker
None
pkgs.rubyPackages_3_4.commonmarker
None
pkgs.rubyPackages_4_0.commonmarker
None
pkgs.haskellPackages.commonmark-cli
Command-line commonmark converter and highlighter
pkgs.python312Packages.recommonmark
Docutils-compatibility bridge to CommonMark
pkgs.python313Packages.recommonmark
Docutils-compatibility bridge to CommonMark
pkgs.python314Packages.recommonmark
Docutils-compatibility bridge to CommonMark
pkgs.rubyPackages.jekyll-commonmark
None
pkgs.tests.nixosOptionsDoc.commonMark
None
pkgs.haskellPackages.commonmark-pandoc
Bridge between commonmark and pandoc AST
pkgs.haskellPackages.commonmark-simple
Simple interface to commonmark-hs
pkgs.haskellPackages.commonmark-initial
An initial encoding of the CommonMark language
pkgs.rubyPackages_3_1.jekyll-commonmark
None
pkgs.rubyPackages_3_2.jekyll-commonmark
None
pkgs.rubyPackages_3_3.jekyll-commonmark
None
pkgs.rubyPackages_3_4.jekyll-commonmark
None
pkgs.rubyPackages_4_0.jekyll-commonmark
None
pkgs.haskellPackages.commonmark-wikilink
Obsidian-friendly commonmark wikilink parser
pkgs.haskellPackages.commonmark-extensions
Pure Haskell commonmark parser
pkgs.rubyPackages.jekyll-commonmark-ghpages
None