Executive brief
A vulnerability in the pymdown-extensions library, which is used to add features to Markdown text processing, can allow an attacker to crash or slow down a website or service. By submitting a specially crafted piece of text less than 50 characters long, an attacker can force the server to consume 100% of its processor power indefinitely. This can lead to a complete denial of service for applications that process user-supplied content, such as comment sections, wikis, or documentation build systems.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) caused by exponential backtracking in four inline processors: caret, tilde, betterem, and magiclink. The regex patterns (SUP2, SUB2, SMART_UNDER_EM2, and RE_LINK) contain ambiguous groupings—specifically inner groups that can partition delimiter runs in exponentially many ways—which the Python 're' engine must exhaustively explore when a match fails. An attacker can trigger this by providing a short (under 50 bytes) unclosed delimiter run in Markdown input. This affects the default configuration of these extensions and is reachable via the public markdown.markdown() API. The issue is fixed in version 11.0.1 by restructuring the regex patterns to eliminate re-partitioning ambiguity.
Affected products
- facelessuser pymdown-extensions <= 11.0.0
Timeline
- 2024-12-01: other: Vulnerability introduced in version 10.13 via PR #2547 for caret/tilde/betterem
- 2026-07-29: disclosed
- 2026-07-29: patched: Fixed in version 11.0.1
- 2026-08-07: advisory