league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan

What’s vulnerable

• League\CommonMark\Extension\Table\TableStartParser::tryStart

  Rescans the whole growing paragraph for a pipe on every line, so a long pipe-free paragraph costs O(n^2)

You’re only affected if

All of these have to be true in your App. If one isn’t, the Advisory doesn’t affect you, even with the vulnerable version installed.

1. The App renders Markdown from untrusted input
2. The Table extension is added to the environment, directly or through GithubFlavoredMarkdownExtension / GithubFlavoredMarkdownConverter

How to check your App

Find every place the App builds a CommonMark converter or environment and check whether TableExtension, GithubFlavoredMarkdownExtension or GithubFlavoredMarkdownConverter is used, and whether the Markdown comes from users.

What the fix changed

2.10.2 stops rescanning the whole paragraph for a pipe on every line, so the table-start check no longer grows quadratically with paragraph length.

Upgrade to 2.10.2. Fix commit: 5f63680.

Review and corrections

Analysed 30 Oct 2026. Reviewed and approved by Craig Hewitt on 30 Oct 2026.

No corrections. When we correct a profile, the change and its date are listed here.

Sources

• GitHub Advisory Database: GHSA-3q6v-r5mr-hxv8
• OSV: GHSA-3q6v-r5mr-hxv8

Advisory metadata comes from the GitHub Advisory Database (CC-BY 4.0) and OSV. The analysis is ours. Profiles describe the conditions for being affected, never a working exploit.

More for Laravel Apps.