The DomainFilteringAdapter in the Embed extension misinterprets domain boundaries, allowing strings such as youtube.com.evil to pass the allowlist when youtube.com is permitted. An attacker can craft a Markdown document that includes such a domain in an embed, causing the commonmark parser to download or render content from a malicious site without the owner's permission. This flaw can lead to content injection or XSS in downstream contexts where rendered HTML is displayed.

Versions 2.3.0 through 2.8.1 of thephpleague commonmark are affected. The vulnerability exists in the Embed extension’s DomainFilteringAdapter before the patch in release 2.8.2. All installations using the unpatched library and accepting user‑supplied Markdown are potentially exposed.

The vulnerability carries a CVSS score of 6.3 (moderate) and an EPSS below 1 %, indicating low exploitation probability. It is not listed in CISA’s KEV catalog. The likely attack vector is server‑side or client‑side code that accepts Markdown from an attacker. Attacker control of the Markdown content is required; no additional authentication or privilege is needed. Because the flaw is a simple allowlist bypass, it can be readily reproducible using the vulnerable merge function, making it a low‑effort exploit.