# CVE-2026-33347: league/commonmark has an embed extension allowed_domains bypass

Source: https://junglewise.ai/threats/cve-2026-33347-league-commonmark-has-an-embed-extension-allowed-domains-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-19  
License: CC BY 4.0 with a link back

CVE-2026-33347 · Severity: medium · CVSS 4 · Published 2026-03-19

league/commonmark has an embed extension allowed_domains bypass

Technologies: [league/commonmark (Packagist)](https://junglewise.ai/threats/technologies/league-commonmark). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-33347 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33347 being exploited in the wild.

**How severe is CVE-2026-33347?** Medium severity, with a CVSS score of 4, published 19 March 2026.

**Which products and versions are affected?** league/commonmark (Packagist) ECOSYSTEM:introduced=2.3.0,fixed=2.8.2.

**Is there a fix for CVE-2026-33347?** Yes. league/commonmark (Packagist): upgrade to 2.8.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2026-33347?** Check whether you run league/commonmark (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- league/commonmark (Packagist): upgrade to 2.8.2 or later

  ```sh
  composer require league/commonmark:^2.8.2
  ```


## Affected products

- league/commonmark (Packagist) ECOSYSTEM:introduced=2.3.0,fixed=2.8.2

## Identifiers

- CVE-2026-33347
- GHSA-hh8v-hgvp-g3f5

## Related threats

- [league/commonmark DisallowedRawHtml XSS bypass in tag parsing](https://junglewise.ai/threats/league-commonmark-disallowedrawhtml-bypassed-when-a-disallowed-tag-name-cea607bc)
- [league/commonmark quadratic DoS in GitHub Flavored Markdown table parser](https://junglewise.ai/threats/league-commonmark-quadratic-time-denial-of-service-in-the-github-a4135205)
- [league/commonmark polynomial time complexity denial of service](https://junglewise.ai/threats/cve-2024-58382-league-commonmark-polynomial-time-complexity-denial-of-service)
- [league/commonmark AttributesExtension XSS bypass with U+000C](https://junglewise.ai/threats/cve-2026-86431-league-commonmark-attributesextension-xss-bypass-with-u-000c)
- [league/commonmark denial of service in parsing](https://junglewise.ai/threats/cve-2026-86430-league-commonmark-denial-of-service-in-parsing)