CVE-2025-68142 PyMdown Extensions has ReDOS bug in Figure Capture extension

What is CVE-2025-68142?

CVE-2025-68142 is a low-severity denial of service vulnerability in facelessuser pymdown-extensions, published on 16 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

PyMdown Extensions is a set of extensions for the `Python-Markdown` markdown project. Versions prior to 10.16.1 have a ReDOS bug found within the figure caption extension (`pymdownx.blocks.caption`). In systems that take unchecked user content, this could cause long hanges when processing the data if a malicious payload was crafted. This issue is patched in Release 10.16.1. As a workaround, those who process unknown user content without timeouts or other safeguards in place to prevent really large, malicious content being aimed at systems may avoid the use of `pymdownx.blocks.caption` until they're able to upgrade.

Weakness: CWE-1333

Which versions are affected by CVE-2025-68142?

3 open source packages ship an affected version, including pymdown-extensions. It affects 1 product.

Products include Facelessuser Pymdown Extensions.

How do I fix CVE-2025-68142?

Upgrade pymdown-extensions to 10.16.1 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2025-68142 being exploited?

There is no known exploitation of CVE-2025-68142 in the wild and no public exploit code.

Other vulnerabilities in facelessuser pymdown-extensions

• CVE-2023-32309 Arbitrary file inclusion with the pymdowm-snippets extension High 7.5
• CVE-2026-46338 Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2025-68142, GHSA-r6h4-mm7h-8pmq, PYSEC-2026-1825, UBUNTU-CVE-2025-68142.