CVE-2026-67422: pymdown-extensions Exponential Backtracking ReDoS in Inline Processors
Summary
CVE-2026-67422: Four inline processors in pymdown-extensions contain regular expressions with exponential backtracking. Affects pymdown-extensions versions < 11.0.1. Fixed in 11.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pymdown-extensions is a popular Python package that enhances the Markdown rendering capabilities by providing additional extensions. It allows users to create more complex and visually appealing documents using Markdown syntax. However, certain inline processors within this package are vulnerable to a specific type of denial-of-service attack due to inefficient regular expressions.
Vulnerability Detail
The vulnerability arises from four inline processors in pymdown-extensions that utilize regular expressions with exponential backtracking. This flaw can lead to unbounded CPU usage when processing untrusted Markdown input, particularly with lines under 50 bytes. The affected processors are 'caret', 'tilde', 'betterem', and 'magiclink'. The issue was introduced in version 10.13 and persists in the latest version 11.0, making it exploitable through the public API. Attackers can leverage this vulnerability to cause denial of service by submitting crafted Markdown lines that stall the rendering process.
How To Fix
Latest published version: 12.3.0 as of 23 Oct 2026
pip install --upgrade "pymdown-extensions==12.3.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
11.0.1
This is the first release that contains the fix.
pip install --upgrade "pymdown-extensions==11.0.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the affected extensions in configurations that process untrusted Markdown input. If possible, sanitize or validate user input before rendering it with pymdown-extensions.
Conclusion
CVE-2026-67422 represents a significant vulnerability in the pymdown-extensions package, allowing for denial of service through inefficient regex patterns. Users are advised to update to the patched version 11.0.1 or later to mitigate this risk. Additionally, utilizing tools like Vulert can help in monitoring and managing vulnerabilities in open-source software.
See every vulnerability recorded for pymdown-extensions →
FAQ
CVE-2026-67422 is a vulnerability in the pymdown-extensions package that allows for denial of service through exponential backtracking in certain inline processors.
If your application uses pymdown-extensions to render user-supplied Markdown, it may become unresponsive if an attacker submits specially crafted input.
Versions up to and including 11.0.0 are affected. The vulnerability was fixed in version 11.0.1.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score for CVE-2026-67422 is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for pymdown-extensions.
