CVE-2025-68142lowCWE-1333

CVE-2025-68142: fallo de gravedad baja en facelessuser pymdown-extensions

PyMdown Extensions has ReDOS bug in Figure Capture extension

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear pymdown-extensions+ Monitorear pymdown-extensions

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

8Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 2.7epss 0.5%
PyMdown Extensions is a set of extensions for the `Python-Markdown` markdown project. Versions prior to 10.16.1 have a ReDOS bug found within the figure caption extension (`pymdownx.blocks.caption`). In systems that take unchecked user content, this could cause long hanges when processing the data if a malicious payload was crafted. This issue is patched in Release 10.16.1. As a workaround, those who process unknown user content without timeouts or other safeguards in place to prevent really large, malicious content being aimed at systems may avoid the use of `pymdownx.blocks.caption` until they're able to upgrade.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U
Productos afectados
facelessuser · pymdown-extensions
CVEs relacionadas — facelessuser pymdown-extensions

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-32309HIGHArbitrary file inclusion with the pymdowm-snippets extensionEPSS 1.7%CVE-2026-67422HIGHpymdown-extensions: Exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processorsEPSS 0.7%CVE-2026-61632MEDIUMPyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_pathEPSS 0.4%CVE-2026-46338MEDIUMPyMdown Extensions: Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_pathEPSS 0.4%