Threats tagged 'brew-mcp-atlassian-cve-2026-67422'

pymdown-extensions versions from 0.11.9 up to but not including 0.22.0 contain a Regular Expression Denial of Service (ReDoS) vulnerability in four inline processors: caret, tilde, betterem, and magiclink. These processors use regular expressions with exponential backtracking, which can cause markdown rendering to consume unbounded CPU time when processing crafted untrusted Markdown input under 50 bytes. The issue affects the default configuration and is exploitable via the documented public API. A fix is available in version 0.22.0.