CVE-2025-68142: PyMdown Extensions ReDOS Vulnerability in Figure Capture Extension
Summary
CVE-2025-68142: PyMdown Extensions has a ReDOS bug in its Figure Capture extension. Affects pymdown-extensions versions < 10.16.1. Fixed in 10.16.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PyMdown Extensions is a popular library designed to enhance Markdown processing in Python applications. It provides various extensions to improve functionality, including the Figure Capture extension, which allows users to add captions to figures in Markdown documents. However, this library has a vulnerability that can be exploited through regular expression denial of service (ReDOS), potentially leading to performance degradation in systems that process untrusted user input.
Vulnerability Detail
The vulnerability arises from a ReDOS bug in the figure caption extension (pymdownx.blocks.caption). The regular expression used for matching figure numbers is susceptible to long execution times when faced with crafted malicious input. This can lead to application hangs, impacting user experience and system reliability. The issue was reported through the normal issue tracker rather than the security process, highlighting a need for better handling of such vulnerabilities in the future.
How To Fix
Minimum fixed version
10.16.1
This is the first release that contains the fix.
pip install --upgrade "pymdown-extensions==10.16.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, avoid using the pymdownx.blocks.caption extension until the library is updated. Implementing input validation and timeouts for processing user content can also mitigate risks associated with this vulnerability.
Conclusion
The ReDOS vulnerability in the PyMdown Extensions library poses a risk to applications that process untrusted user input through the Figure Capture extension. Users are encouraged to update to the patched version 10.16.1 or later to mitigate this risk. In the meantime, implementing workarounds can help protect against potential exploitation.
See every vulnerability recorded for pymdown-extensions →
FAQ
ReDOS stands for Regular Expression Denial of Service, a type of attack that exploits the performance characteristics of regular expressions to cause applications to hang or crash.
You can check if your application is affected by using Vulert's playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring signup.
The primary consequence is that an attacker can craft malicious input that causes the application to hang, leading to degraded performance and potential denial of service.
Yes, the vulnerability has been patched in version 10.16.1 of the PyMdown Extensions package. Users should upgrade to this version or later.
If you cannot upgrade, avoid using the affected extension and implement safeguards such as input validation and timeouts to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for pymdown-extensions.
