CVE-2026-33347 MEDIUM

CVE-2026-33347: league/commonmark has an embed extension allowed_domains bypass

Vendor Thephpleague

Product commonmark

Weakness CWE-79 · XSS

Published March 24, 2026

Last update March 26, 2026

View on NVD All CVEs

CVSS base score

6.3/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

What the vulnerability does

01Description

league/commonmark is a PHP Markdown parser. From version 2.3.0 to before version 2.8.2, the DomainFilteringAdapter in the Embed extension is vulnerable to an allowlist bypass due to a missing hostname boundary assertion in the domain-matching regex. An attacker-controlled domain like youtube.com.evil passes the allowlist check when youtube.com is an allowed domain. This issue has been patched in version 2.8.2.

Key dates

02Disclosure timeline

March 24, 2026 CVE published

March 26, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-33347 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2025-7815 PHPGurukul Apartment Visitors Management System HTTP POST Request manage-newvisitors.php cross site scripting CVE-2023-40684 IBM Content Navigator cross-site scripting CVE-2025-66021 OWASP Java HTML Sanitizer is vulnerable to XSS via noscript tag and improper style tag sanitization CVE-2025-23709 WordPress Formatted post plugin <= 1.01 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2024-9165 Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) <= 4.4.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload