PyMdown Extensions has ReDOS bug in Figure Capture extension

Vulnerability

CVE-2025-68142 describes a Regular Expression Denial of Service (ReDoS) vulnerability in the pymdownx.blocks.caption extension of PyMdown Extensions, a collection of extensions for the Python-Markdown library [1]. The flaw resides in the regular expression used to parse figure caption numbers: RE_FIG_NUM = re.compile(r'^(\^)?([1-9][0-9]*(?:.[1-9][0-9]*)*)(?= |$)'). The subpattern (?:.[1-9][0-9]*)* uses a bare . which matches any character instead of the intended literal period \., leading to catastrophic backtracking on crafted input [4].

Exploitation

The vulnerability is triggered when an attacker supplies markdown content containing a specially crafted string that matches the pattern in an inefficient way. The advisory notes that a proof-of-concept was created demonstrating exponential time increases with longer strings of '1' followed by 'a' [4]. Systems that accept unchecked user-generated markdown without timeouts or other safeguards are at risk. The issue can be triggered by any user able to submit markdown content to a service that uses the figure caption extension [1].

Impact

Successful exploitation can cause prolonged processing of the markdown content, leading to denial of service (DoS) through excessive CPU consumption. This can hang the application, degrade performance for other users, or exhaust server resources. An attacker does not need authentication if the application processes unauthenticated input [1][4].

Mitigation

The vulnerability is patched in PyMdown Extensions release 10.16.1 [2]. The fix corrects the regex to use the escaped period \. [4]. As a workaround, administrators who cannot immediately upgrade are advised to avoid using the pymdownx.blocks.caption extension or to implement input timeouts and size limits [1].