CVE-2025-68142

The record

PyMdown Extensions is a set of extensions for the `Python-Markdown` markdown project. Versions prior to 10.16.1 have a ReDOS bug found within the figure caption extension (`pymdownx.blocks.caption`). In systems that take unchecked user content, this could cause long hanges when processing the data if a malicious payload was crafted. This issue is patched in Release 10.16.1. As a workaround, those who process unknown user content without timeouts or other safeguards in place to prevent really large, malicious content being aimed at systems may avoid the use of `pymdownx.blocks.caption` until they're able to upgrade.

Affected packages

Related vulnerabilities

• GHSA-r6h4-mm7h-8pmq PyMdown Extensions has a ReDOS bug in its Figure Capture extension Same vulnerability
• CVE-2026-112901 Pillow is a Python imaging library. CWE-1333
• CVE-2026-106454 Twisted is an event-based framework for internet applications, supporting Python 3.6+. CWE-1333
• CVE-2026-77387 geopy is a geocoding library for Python. CWE-1333
• CVE-2026-102990 basic-ftp is an FTP client for Node.js. CWE-1333
• CVE-2026-102473 A flaw was found in dash. CWE-1333
• CVE-2026-102270 PyJWT is a Python implementation of JSON Web Token standards. CWE-1333
• CVE-2026-101906 Axios is a promise-based HTTP client for the browser and Node.js. CWE-1333