Is CVE-2026-67422 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-67422 being exploited in the wild.

How severe is CVE-2026-67422?

High severity, with a CVSS score of 7.5, published 6 August 2026.

Which products and versions are affected?

pymdown-extensions (PyPI) <= 11.0.0, ECOSYSTEM:introduced=0,fixed=11.0.1.

Is there a fix for CVE-2026-67422?

Yes. pymdown-extensions (PyPI): upgrade to 11.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-67422 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-67422?

Check whether you run pymdown-extensions (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-67422: facelessuser pymdown-extensions ReDoS in multiple inline processors

Q: Is there a fix for CVE-2026-67422?

Yes. pymdown-extensions (PyPI): upgrade to 11.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-67422 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-67422?

Check whether you run pymdown-extensions (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-67422 · Severity: high · CVSS 7.5 · Published 2026-08-06

A vulnerability in the pymdown-extensions library, which is used to add features to Markdown text processing, can allow an attacker to crash or slow down a website or service. By submitting a specially crafted piece of text less than 50 characters long, an attacker can force the server to consume 100% of its processor power indefinitely. This can lead to a complete denial of service for applications that process user-supplied content, such as comment sections, wikis, or documentation build systems.

Technologies: pymdown-extensions (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-67422 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-67422 being exploited in the wild.
How severe is CVE-2026-67422?: High severity, with a CVSS score of 7.5, published 6 August 2026.
Which products and versions are affected?: pymdown-extensions (PyPI) <= 11.0.0, ECOSYSTEM:introduced=0,fixed=11.0.1.
Is there a fix for CVE-2026-67422?: Yes. pymdown-extensions (PyPI): upgrade to 11.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-67422 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-67422?: Check whether you run pymdown-extensions (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pymdown-extensions (PyPI): upgrade to 11.0.1 or later
```
pip install "pymdown-extensions>=11.0.1"
```

Technical details

The vulnerability is a Regular Expression Denial of Service (ReDoS) caused by exponential backtracking in four inline processors: caret, tilde, betterem, and magiclink. The regex patterns (SUP2, SUB2, SMART_UNDER_EM2, and RE_LINK) contain ambiguous groupings—specifically inner groups that can partition delimiter runs in exponentially many ways—which the Python 're' engine must exhaustively explore when a match fails. An attacker can trigger this by providing a short (under 50 bytes) unclosed delimiter run in Markdown input. This affects the default configuration of these extensions and is reachable via the public markdown.markdown() API. The issue is fixed in version 11.0.1 by restructuring the regex patterns to eliminate re-partitioning ambiguity.

Affected products

facelessuser pymdown-extensions <= 11.0.0

Identifiers

CVE-2026-67422
GHSA-gm37-52c6-37mw
PYSEC-2026-3654

Timeline

2024-12-01: other: Vulnerability introduced in version 10.13 via PR #2547 for caret/tilde/betterem
2026-07-29: disclosed
2026-07-29: patched: Fixed in version 11.0.1
2026-08-07: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.