CVE-2026-67422

Name of the Vulnerable Software and Affected Versions pymdown-extensions versions prior to 11.0.1

Description Four inline processors (caret, tilde, betterem, and magiclink) use regular expressions that can cause catastrophic backtracking—a condition where the regex engine takes an exponential amount of time to process a string—when handling delimiter characters. An unauthenticated remote attacker can submit a specially crafted Markdown line of less than 50 bytes to be rendered via the markdown.markdown() function, leading to unbounded CPU usage and a denial of service. This issue affects web applications rendering user-supplied content such as comments, wikis, and issue bodies, as well as CI systems and hosted documentation platforms. Applications using pymdownx.extra are also affected as it includes the vulnerable betterem default.

Recommendations Update to version 11.0.1.