CVE-2019-10010

NameCVE-2019-10010
DescriptionCross-site scripting (XSS) vulnerability in the PHP League CommonMark library before 0.18.3 allows remote attackers to insert unsafe links into HTML by using double-encoded HTML entities that are not properly escaped during rendering, a different vulnerability than CVE-2018-20583.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
php-league-commonmark (PTS)bookworm2.3.9-1+deb12u1fixed
trixie2.7.0-1+deb13u1fixed
forky, sid2.10.0-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
php-league-commonmarksource(unstable)(not affected)

Notes

- php-league-commonmark <not-affected> (Fixed before initial upload to Debian)
https://github.com/thephpleague/commonmark/security/advisories/GHSA-3v43-877x-qgmq
Search for package or bug name: Reporting problems