PyMdown Extensions is a set of extensions for the `Python-Markdown` markdown project. Versions prior to 10.16.1 have a ReDOS bug found within the figure caption extension (`pymdownx.blocks.caption`). In systems that take unchecked user content, this could cause long hanges when processing the data if a malicious payload was crafted. This issue is patched in Release 10.16.1. As a workaround, those who process unknown user content without timeouts or other safeguards in place to prevent really large, malicious content being aimed at systems may avoid the use of `pymdownx.blocks.caption` until they're able to upgrade.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - PyMdown Extensions is a set of extensions for the `Python-Markdown` markdown project. Versions prior to
    10.16.1 have a ReDOS bug found within the figure caption extension (`pymdownx.blocks.caption`). In systems
    that take unchecked user content, this could cause long hanges when processing the data if a malicious
    payload was crafted. This issue is patched in Release 10.16.1. As a workaround, those who process unknown
    user content without timeouts or other safeguards in place to prevent really large, malicious content
    being aimed at systems may avoid the use of `pymdownx.blocks.caption` until they're able to upgrade.
    (CVE-2025-68142)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - PyMdown Extensions is a set of extensions for the `Python-Markdown` markdown project. Versions prior to     10.16.1 have a ReDOS bug found within the figure caption extension (`pymdownx.blocks.caption`). In systems     that take unchecked user content, this could cause long hanges when processing the data if a malicious     payload was crafted. This issue is patched in Release 10.16.1. As a workaround, those who process unknown     user content without timeouts or other safeguards in place to prevent really large, malicious content     being aimed at systems may avoid the use of `pymdownx.blocks.caption` until they're able to upgrade.
    (CVE-2025-68142)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
436404	SCA: security update for pymdown-extensions (GHSA-r6h4-mm7h-8pmq)	Tenable Cloud Security	SCA Checks	medium
436404	SCA: security update for pymdown-extensions (GHSA-r6h4-mm7h-8pmq)	Tenable Self-Hosted Container Security	SCA Checks	medium
278975	Linux Distros Unpatched Vulnerability : CVE-2025-68142	Nessus	Misc.	medium

Detections

Analytics

CVE-2025-68142

medium

Tenable Plugins

medium

medium

medium