PT-2026-26486 · League+4 · Commonmark+5

Huajihd · Published 2026-01-01 · Updated 2026-04-21 · CVE-2026-33347

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions league/commonmark versions 2.3.0 through 2.8.1

Description The DomainFilteringAdapter within the Embed extension is susceptible to an allowlist bypass because of a missing hostname boundary assertion in the domain-matching regular expression. A malicious domain, such as youtube.com.evil, can pass the allowlist check when youtube.com is a permitted domain. This allows for two potential attack vectors: Server-Side Request Forgery (SSRF) and Cross-Site Scripting (XSS). The OscaroteroEmbedAdapter makes server-side HTTP requests to the embed URL, and a bypassed domain filter could lead to requests to attacker-controlled hosts. The EmbedRenderer outputs the oEmbed response HTML directly into the page without sanitization, allowing an attacker controlling the bypassed domain to return arbitrary HTML/JavaScript.

Recommendations Update to version 2.8.2 or later. Disable the Embed extension. Provide a custom domain-filtering implementation of EmbedAdapterInterface. Enable a Content Security Policy (CSP) and outbound firewall restrictions.

Exploit

Fix

XSS

SSRF

Weakness Enumeration

CWE-79

CWE-185

CWE-918

Related Identifiers

CVE-2026-33347

GHSA-HH8V-HGVP-G3F5

USN-8194-1

Affected Products

Embed

Embedrenderer

Linuxmint

Oscaroteroembedadapter

Ubuntu

Commonmark

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33347.json · Exploit
• https://github.com/thephpleague/commonmark/commit/59fb075d2101740c337c7216e3f32b36c204218b · Patch
• https://github.com/thephpleague/commonmark/security/advisories/GHSA-hh8v-hgvp-g3f5 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33347 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8194-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-33347 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-33347 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33347 · Security Note
• https://ubuntu.com/security/notices/USN-8194-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-46734 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-30838 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33347 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hh8v-hgvp-g3f5 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-33347 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-33347 · Security Note