Description
PyMdown Extensions is a set of extensions for the `Python-Markdown` markdown project. Versions prior to 10.16.1 have a ReDOS bug found within the figure caption extension (`pymdownx.blocks.caption`). In systems that take unchecked user content, this could cause long hanges when processing the data if a malicious payload was crafted. This issue is patched in Release 10.16.1. As a workaround, those who process unknown user content without timeouts or other safeguards in place to prevent really large, malicious content being aimed at systems may avoid the use of `pymdownx.blocks.caption` until they're able to upgrade.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| facelessuser | pymdown-extensions | < 10.16.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pymdown-extensions | 10.13-4 | — |
| Debian 13 | pymdown-extensions | 10.13-1+deb13u1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | pymdown-extensions | No fix yet | — |
| Ubuntu 26.04 LTS | pymdown-extensions | No fix yet | — |
| Ubuntu 25.10 | pymdown-extensions | No fix yet | — |
| Ubuntu 24.04 LTS | pymdown-extensions | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | pymdown-extensions | < 10.16.1 | 10.16.1 | GHSA-r6h4-mm7h-8pmq |