pymdown-extensions is a collection of extensions for the Python Markdown library. In versions up to and including 11.0, four inline processors (caret, tilde, betterem, and magiclink) use regular expressions whose content groups can partition a run of delimiter characters in exponentially many ways, causing catastrophic backtracking. As a result, a single untrusted Markdown line under 50 bytes rendered with markdown.markdown() in each extension's default configuration drives the rendering thread into unbounded CPU usage that grows exponentially with input length, enabling an unauthenticated remote attacker who can submit Markdown to cause denial of service. The exposure is concrete for web applications that render user-supplied Markdown (comments, wikis, issue bodies, live preview), including any app using pymdownx.extra which bundles the vulnerable betterem default, as well as hosted docs/CI systems that build untrusted Markdown. The issue has been fixed in version 11.0.1.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - pymdown-extensions is a collection of extensions for the Python Markdown library. In versions up to and
    including 11.0, four inline processors (caret, tilde, betterem, and magiclink) use regular expressions
    whose content groups can partition a run of delimiter characters in exponentially many ways, causing
    catastrophic backtracking. As a result, a single untrusted Markdown line under 50 bytes rendered with
    markdown.markdown() in each extension's default configuration drives the rendering thread into unbounded
    CPU usage that grows exponentially with input length, enabling an unauthenticated remote attacker who can
    submit Markdown to cause denial of service. The exposure is concrete for web applications that render
    user-supplied Markdown (comments, wikis, issue bodies, live preview), including any app using
    pymdownx.extra which bundles the vulnerable betterem default, as well as hosted docs/CI systems that build
    untrusted Markdown. The issue has been fixed in version 11.0.1. (CVE-2026-67422)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - pymdown-extensions is a collection of extensions for the Python Markdown library. In versions up to and     including 11.0, four inline processors (caret, tilde, betterem, and magiclink) use regular expressions     whose content groups can partition a run of delimiter characters in exponentially many ways, causing     catastrophic backtracking. As a result, a single untrusted Markdown line under 50 bytes rendered with     markdown.markdown() in each extension's default configuration drives the rendering thread into unbounded     CPU usage that grows exponentially with input length, enabling an unauthenticated remote attacker who can     submit Markdown to cause denial of service. The exposure is concrete for web applications that render     user-supplied Markdown (comments, wikis, issue bodies, live preview), including any app using     pymdownx.extra which bundles the vulnerable betterem default, as well as hosted docs/CI systems that build     untrusted Markdown. The issue has been fixed in version 11.0.1. (CVE-2026-67422)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
461195	Echo: pymdown-extensions: security update to 11.0.1	Tenable Cloud Security	Echo Local Security Checks	Local	high
461195	Echo: pymdown-extensions: security update to 11.0.1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
333354	Linux Distros Unpatched Vulnerability : CVE-2026-67422	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-67422

high

Tenable Plugins

high

high

high