{"id":"CVE-2026-33347","aliases":["GHSA-hh8v-hgvp-g3f5"],"url":"https://o3.security/vulnerability/CVE-2026-33347","summary":"league/commonmark has an embed extension allowed_domains bypass","details":"### Impact\n\nThe `DomainFilteringAdapter` in the Embed extension is vulnerable to an allowlist bypass due to a missing hostname boundary assertion in the domain-matching regex. An attacker-controlled domain like `youtube.com.evil` passes the allowlist check when `youtube.com` is an allowed domain.\n\nThis enables two attack vectors:\n\n- **SSRF**: The `OscaroteroEmbedAdapter` makes server-side HTTP requests to the embed URL via the `embed/embed` library. A bypassed domain filter causes the server to make outbound requests to an attacker-controlled host, potentially probing internal services or exfiltrating request metadata.\n- **XSS**: `EmbedRenderer` outputs the oEmbed response HTML directly into the page with no sanitization. An attacker controlling the bypassed domain can return arbitrary HTML/JavaScript in their oEmbed response, which is rendered verbatim.\n\nAny application using the `Embed` extension and relying on `allowed_domains` to restrict domains when processing untrusted Markdown input is affected.\n\n### Patches\n\nThis has been patched in version **2.8.2**. The fix replaces the regex-based domain check with explicit hostname parsing using `parse_url()`, ensuring exact domain and subdomain matching only.\n\n### Workarounds\n\n- Disable the `Embed` extension, or restrict its use to trusted users\n- Provide your own domain-filtering implementation of `EmbedAdapterInterface`\n- Enable a [Content Security Policy (CSP)](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) and outbound firewall restrictions","published":"2026-03-24T19:26:23.872Z","modified":"2026-08-12T03:51:19.936652742Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"league/commonmark","fixedVersion":"2.8.2"}],"fix":{"url":"https://github.com/thephpleague/commonmark/commit/59fb075d2101740c337c7216e3f32b36c204218b","label":"thephpleague/commonmark@59fb075"},"references":[{"type":"WEB","url":"https://github.com/thephpleague/commonmark/releases/tag/2.8.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33347.json"},{"type":"ADVISORY","url":"https://github.com/thephpleague/commonmark/security/advisories/GHSA-hh8v-hgvp-g3f5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33347"},{"type":"FIX","url":"https://github.com/thephpleague/commonmark/commit/59fb075d2101740c337c7216e3f32b36c204218b"},{"type":"PACKAGE","url":"https://github.com/thephpleague/commonmark"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:19.936652742Z"}}