Inefficient regular expression complexity in pymdown-extensions - #VU162828
Published: November 9, 2026
Vulnerability identifier: #VU162828
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-1333
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to cause denial of service in applications rendering untrusted Markdown with the HTML or Caption blocks extension enabled.
The vulnerability exists due to exponential regular expression backtracking when pymdown-extensions parses malformed CSS-style selector arguments in those extensions. An unauthenticated remote attacker can submit a crafted Markdown block smaller than 60 bytes to consume a rendering thread's CPU for tens of seconds.
Affected software
pymdown-extensions
Remediation
Install security update from vendor's website.
pymdown-extensions - update to 11.0.2