Threat Intelligence Database

CVE-2026-67422 is a high-severity vulnerability in pymdown-extensions up to version 11.0. Four inline processors use inefficient regular expressions that cause catastrophic backtracking, leading to unbounded CPU usage when rendering certain Markdown inputs. This can be exploited by unauthenticated remote attackers submitting crafted Markdown to cause denial of service. The issue affects applications rendering untrusted Markdown, such as web comments, wikis, and documentation systems. The vulnerability is fixed in version 11.0.1.

PyMdown Extensions versions up to and including 10.21.3 contain a path traversal vulnerability in the b64 extension. This flaw allows an attacker controlling Markdown input to cause the extension to read arbitrary files with certain image extensions outside the intended base directory. The file contents are then base64-encoded and included in the rendered output, potentially leaking sensitive information. The vulnerability is fixed in version 11.0.