CVE-2026-67422

{
  "id": "CVE-2026-67422",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-06T22:18:21.600",
  "lastModified": "2026-10-24T16:10:00.153",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "pymdown-extensions is a collection of extensions for the Python Markdown library. In versions up to and including 11.0, four inline processors (caret, tilde, betterem, and magiclink) use regular expressions whose content groups can partition a run of delimiter characters in exponentially many ways, causing catastrophic backtracking. As a result, a single untrusted Markdown line under 50 bytes rendered with markdown.markdown() in each extension's default configuration drives the rendering thread into unbounded CPU usage that grows exponentially with input length, enabling an unauthenticated remote attacker who can submit Markdown to cause denial of service. The exposure is concrete for web applications that render user-supplied Markdown (comments, wikis, issue bodies, live preview), including any app using pymdownx.extra which bundles the vulnerable betterem default, as well as hosted docs/CI systems that build untrusted Markdown. The issue has been fixed in version 11.0.1."
    },
    {
      "lang": "es",
      "value": "pymdown-extensions es una colección de extensiones para la biblioteca Python Markdown. En versiones hasta la 11.0 inclusive, cuatro procesadores en línea (caret, tilde, betterem y magiclink) utilizan expresiones regulares cuyos grupos de contenido pueden particionar una secuencia de caracteres delimitadores de exponencialmente muchas maneras, causando retroceso catastrófico. Como resultado, una única línea de Markdown no confiable de menos de 50 bytes renderizada con markdown.markdown() en la configuración predeterminada de cada extensión lleva el hilo de renderizado a un uso ilimitado de CPU que crece exponencialmente con la longitud de la entrada, permitiendo a un atacante remoto no autenticado que puede enviar Markdown causar denegación de servicio. La exposición es concreta para aplicaciones web que renderizan Markdown proporcionado por el usuario (comentarios, wikis, cuerpos de incidencias, vista previa en vivo), incluyendo cualquier aplicación que use pymdownx.extra que incluye el valor predeterminado vulnerable de betterem, así como sistemas de documentación/CI alojados que construyen Markdown no confiable. El problema ha sido solucionado en la versión 11.0.1."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "facelessuser",
          "product": "pymdown-extensions",
          "versions": [
            {
              "version": "< 11.0.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-07T16:59:03.019688Z",
          "id": "CVE-2026-67422",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1333"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/facelessuser/pymdown-extensions/commit/c68498598d7b13011bb4571350b6e3612a4ce44b",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-gm37-52c6-37mw",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-gm37-52c6-37mw",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}