Inefficient regular expression complexity in pymdown-extensions - CVE-2026-67422
Published: August 3, 2026
Vulnerability identifier: #VU140821
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-67422
CWE-ID: CWE-1333
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to inefficient regular expression complexity in the caret, tilde, betterem, and magiclink inline processors when rendering untrusted Markdown input through the public API in the default configuration. A remote attacker can submit a specially crafted Markdown line to cause a denial of service.
A single untrusted Markdown line under 50 bytes can drive the rendering thread into unbounded CPU usage.
Affected software
pymdown-extensions
How to mitigate CVE-2026-67422
Install security update from vendor's website.
pymdown-extensions - update to 11.0.1