{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:5be92a39-87f7-5c8e-a5b4-a9fae2a84033", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "commonmark", "purl": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare", "type": "library", "group": "league", "bom-ref": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare", "version": "2.8.2-p4+tuxcare", "pedigree": { "ancestors": [ { "name": "commonmark", "purl": "pkg:composer/league/commonmark@2.8.2", "type": "library", "group": "league", "version": "2.8.2" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-46734", "affects": [ { "ref": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare" } ], "bom-ref": "urn:uuid:ff7a0b03-71af-5abe-8c2f-c09bd71f7e05", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-46734 does not affect version 2.8.2-p4+tuxcare of league/commonmark. not_affected \u2014 Target version 2.8.2-p4+tuxcare is not affected by CVE-2025-46734. The XSS vulnerability in the Attributes extension was fixed by upstream maintainer Colin O'Dell in commit 43207253 (May 5, 2025), which was included in upstream release 2.7.0. When TuxCare onboarded version 2.8.2 via snapshot commit 9e8d7678 (May 13, 2026), the fix was already present. All three mitigation measures from the CVE ...", "justification": "code_not_present" } }, { "id": "CVE-2026-30838", "affects": [ { "ref": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare" } ], "bom-ref": "urn:uuid:cb9644a6-484b-5879-92bc-a481cf7e17e3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-30838 does not affect version 2.8.2-p4+tuxcare of league/commonmark. not_affected \u2014 The target (league/commonmark version 2.8.2) is not affected by CVE-2026-30838. The vulnerability involves a DisallowedRawHtml extension regex bypass allowing XSS via whitespace (newline/tab) between HTML tag names and closing `>`. The vulnerable pattern `[ \\/>]` (matches only space) was fixed upstream in version 2.8.1 by changing to `[\\s\\/>]` (matches all whitespace). The TuxCare snapshot impo...", "justification": "code_not_present" } }, { "id": "CVE-2026-33347", "affects": [ { "ref": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare" } ], "bom-ref": "urn:uuid:35d7b771-7c1f-56b7-931b-1738c1bad57b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-33347 does not affect version 2.8.2-p4+tuxcare of league/commonmark. not_affected \u2014 CVE-2026-33347 describes a regex-based allowlist bypass in DomainFilteringAdapter where domains like `youtube.com.evil` could match allowlist entry `youtube.com`, enabling SSRF and XSS attacks. The target (version 2.8.2, SHA 48469075) contains the fixed implementation that uses `parse_url()` for explicit hostname extraction and proper boundary checking via `\\str_ends_with($host, '.' . $domain)`...", "justification": "code_not_present" } }, { "id": "CVE-2026-71478", "affects": [ { "ref": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare" } ], "bom-ref": "urn:uuid:a1ae31ca-6048-57fb-8e29-4ea0f56bfcd8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-71478 is fixed in version 2.8.2-p4+tuxcare of league/commonmark." } }, { "id": "CVE-2026-71488", "affects": [ { "ref": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare" } ], "bom-ref": "urn:uuid:1c803dc5-5168-5dfa-9ba5-d0ef4c3f18c8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-71488 is fixed in version 2.8.2-p4+tuxcare of league/commonmark." } }, { "id": "GHSA-3q6v-r5mr-hxv8", "affects": [ { "ref": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare" } ], "bom-ref": "urn:uuid:b17a6123-c7c0-528e-997b-5a101e2d7800", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-3q6v-r5mr-hxv8 is fixed in version 2.8.2-p4+tuxcare of league/commonmark." } }, { "id": "GHSA-8rr7-cvq3-gmfh", "affects": [ { "ref": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare" } ], "bom-ref": "urn:uuid:0094e51a-6082-5e2b-a080-4d01fdf54146", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-8rr7-cvq3-gmfh is fixed in version 2.8.2-p4+tuxcare of league/commonmark." } }, { "id": "GHSA-97jj-33gv-5xf9", "affects": [ { "ref": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare" } ], "bom-ref": "urn:uuid:145020e4-9eeb-5d39-b97d-dab6fddb3b7b", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-97jj-33gv-5xf9 is fixed in version 2.8.2-p4+tuxcare of league/commonmark." } }, { "id": "GHSA-c2pc-g5qf-rfrf", "affects": [ { "ref": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare" } ], "bom-ref": "urn:uuid:f9e4a45a-1f5c-5313-b6e7-1a87566ed23a", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-c2pc-g5qf-rfrf affects version 2.8.2-p4+tuxcare of league/commonmark." } }, { "id": "GHSA-f8fg-pg57-v4j8", "affects": [ { "ref": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare" } ], "bom-ref": "urn:uuid:008f8fa9-4b17-5bf6-a586-2c218d745fdc", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-f8fg-pg57-v4j8 is fixed in version 2.8.2-p4+tuxcare of league/commonmark." } }, { "id": "GHSA-g2gp-3wwq-f4ph", "affects": [ { "ref": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare" } ], "bom-ref": "urn:uuid:8961c165-8e04-5e71-963a-b9bf1630ea31", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-g2gp-3wwq-f4ph is fixed in version 2.8.2-p4+tuxcare of league/commonmark." } }, { "id": "GHSA-j8pm-gj4c-rq4x", "affects": [ { "ref": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare" } ], "bom-ref": "urn:uuid:81822a54-4d80-52aa-adb5-f527ec58e109", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-j8pm-gj4c-rq4x is fixed in version 2.8.2-p4+tuxcare of league/commonmark." } }, { "id": "GHSA-jfm3-95jq-q3rf", "affects": [ { "ref": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare" } ], "bom-ref": "urn:uuid:ad103feb-c0aa-5708-992b-903fe7819719", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-jfm3-95jq-q3rf is fixed in version 2.8.2-p4+tuxcare of league/commonmark." } }, { "id": "GHSA-jjv6-8j6v-6j52", "affects": [ { "ref": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare" } ], "bom-ref": "urn:uuid:2b026c36-9b81-5f14-b470-477c0b39d619", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-jjv6-8j6v-6j52 is fixed in version 2.8.2-p4+tuxcare of league/commonmark." } }, { "id": "GHSA-mh25-x5hq-wrqp", "affects": [ { "ref": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare" } ], "bom-ref": "urn:uuid:185b1ddf-453e-57a5-a60c-267c2f8eaa7c", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-mh25-x5hq-wrqp is fixed in version 2.8.2-p4+tuxcare of league/commonmark." } }, { "id": "GHSA-mj63-m3rc-8ppr", "affects": [ { "ref": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare" } ], "bom-ref": "urn:uuid:6a7e1df4-0eba-524c-adae-ff86089d8121", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-mj63-m3rc-8ppr is fixed in version 2.8.2-p4+tuxcare of league/commonmark." } } ], "dependencies": [ { "ref": "pkg:composer/league/commonmark@2.8.2-p4+tuxcare" } ] }