SB20261109107 - Multiple vulnerabilities in pymdown-extensions

Description

This security bulletin contains information about 2 vulnerabilities.

1) Inefficient regular expression complexity (CVE-ID: N/A)

CWE-ID: CWE-1333 - Inefficient Regular Expression Complexity

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an unauthenticated remote attacker to cause denial of service in applications rendering untrusted Markdown with the HTML or Caption blocks extension enabled.

The vulnerability exists due to exponential regular expression backtracking when pymdown-extensions parses malformed CSS-style selector arguments in those extensions. An unauthenticated remote attacker can submit a crafted Markdown block smaller than 60 bytes to consume a rendering thread's CPU for tens of seconds.

2) Inefficient regular expression complexity (CVE-ID: N/A)

CWE-ID: CWE-1333 - Inefficient Regular Expression Complexity

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an unauthenticated remote attacker to cause denial of service in applications rendering untrusted Markdown with the optional pymdownx.keys extension enabled.

The vulnerability exists due to ambiguous quoted-key regular expressions in pymdown-extensions that trigger exponential backtracking on unterminated quoted keys containing repeated backslashes. An unauthenticated remote attacker can submit a crafted 42-byte Markdown document that consumes approximately 36 seconds of CPU time during rendering.

Remediation

Install update from vendor's website.

References

• https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-j5pm-9mx9-pggq
• https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-mw73-8637-g65g