I wonder how much work it would be to add support for this to Raph's pure Rust CommonMark parser [0]. Pull parsing lends itself quite nicely to the AST-based output that GitHub prefer and Rust should help to minimise some of the security issues.
For those interested, here is the direct link to the new GFM spec: https://github.github.com/gfm/