CVE-2018-20583

Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library versions 0.15.6 through 0.18.x before 0.18.1 allows remote attackers to insert unsafe URLs into HTML (even if allow_unsafe_links is false) via a newline character (e.g., writing javascript as javascri%0apt).

• CWE-79

• https://commonmark.thephpleague.com/changelog/Release Notes, Third Party Advisory
• https://github.com/thephpleague/commonmark/issues/337Exploit, Third Party Advisory
• https://github.com/thephpleague/commonmark/releases/tag/0.18.1Release Notes, Third Party Advisory
• https://commonmark.thephpleague.com/changelog/Release Notes, Third Party Advisory
• https://github.com/thephpleague/commonmark/issues/337Exploit, Third Party Advisory
• https://github.com/thephpleague/commonmark/releases/tag/0.18.1Release Notes, Third Party Advisory

Published

Dec 30, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-20577Orange Livebox 00.96.320S devices allow cgi-bin/restore.exe,…
• CVE-2018-20578An issue was discovered in NuttX before 7.27. The function n…
• CVE-2018-20579Contiki-NG before 4.2 has a stack-based buffer overflow in t…
• CVE-2018-2058Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2018-20580The WSDL import functionality in SmartBear ReadyAPI 2.5.0 an…
• CVE-2018-20582The GREE+ (aka com.gree.greeplus) application 1.4.0.8 for An…8.8
• CVE-2018-20584JasPer 2.0.14 allows remote attackers to cause a denial of s…6.5
• CVE-2018-20586bitcoind and Bitcoin-Qt prior to 0.17.1 allow injection of a…5.3
• CVE-2018-20587Bitcoin Core 0.12.0 through 0.17.1 and Bitcoin Knots 0.12.0 …
• CVE-2018-20588lib/support/unicodeconv/unicodeconv.c in libotfcc.a in otfcc…
• CVE-2018-20589Ivan Cordoba Generic Content Management System (CMS) through…
• CVE-2018-2059Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…