CVE-2025-46734

[justinrclarke]

league/commonmark contains an XSS vulnerability in the Attributes extension

I just installed the package into a new project and see that it contains a dependency with a registered CVE as of May 15th, 2025.

[erikn69]

• Not from this package, and already fixed on [12.x] Bump minimum league/commonmark laravel/framework#55659

[mfn]

Thank you @erikn69 !

[justinrclarke]

Thanks @erikn69 for the correction.