What is CVE-2026-67422?

CVE-2026-67422 is a high-severity vulnerability in Facelessuser Pymdown-extensions, classified under Inefficient Regular Expression Complexity. CVSS score: 7.5/10. Published 2026-08-06.

How severe is CVE-2026-67422?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Facelessuser Pymdown-extensions

CVE-2026-67422

pymdown-extensions is a collection of extensions for the Python Markdown library. In versions up to and including 11.0, four inline processors (caret, tilde, betterem, and magiclink) use regular expressions whose content groups can partiti…

Vulnerability class: ReDoS (Regular Expression Denial of Service)

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

Facelessuser Pymdown-extensions — versions < 11.0.1

Weakness classification (CWE)

CWE-1333 — Inefficient Regular Expression Complexity

References

security-advisories@github.com (x_refsource_MISC)
security-advisories@github.com (x_refsource_CONFIRM)

Frequently asked questions

What is CVE-2026-67422?: CVE-2026-67422 is a high-severity vulnerability in Facelessuser Pymdown-extensions, classified under Inefficient Regular Expression Complexity. CVSS score: 7.5/10. Published 2026-08-06.
How severe is CVE-2026-67422?: High severity. CVSS v3 base score is 7.5 out of 10.