The pymdown-extensions library, a collection of extensions for the Python Markdown library, is vulnerable to a denial of service attack. Versions up to and including 11.0 contain four inline processors (caret, tilde, betterem, and magiclink) that use regular expressions which can cause catastrophic backtracking. This results in exponentially increasing CPU usage when rendering specially crafted Markdown l [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-06T22:18:11.410Z and has not been modified since then. CVE-2026-61632 is a path traversal vulnerability in PyMdown Extensions versions up to and including 10.21.3. The b64 extension inlines images referenced by <img src='...'> by joining the src onto the configured base_path with os.path.normpath an [truncated]
CVE-2026-46338 is a vulnerability in PyMdown Extensions, a set of extensions for the Python-Markdown markdown project. The issue, fixed in version 10.21.3, allows markdown snippet directives to read files from sibling paths with the same base_path prefix when `restrict_base_path: True`. This is a regression of CVE-2023-32309. Affected users should review and restrict base paths for markdown snippet direct [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-14T21:17:02.007Z and has not been modified since then. The NVD entry is currently Undergoing Analysis. This denial-of-service vulnerability affects Soup Sieve and Beautiful Soup 4 users, who should be aware and ensure they are using a patched version of Soup Sieve. The vulnerability is caused by a r [truncated]
CVE-2026-49476 is a denial of service vulnerability in Soup Sieve, a CSS selector library for Beautiful Soup 4. Prior to version 2.8.4, the library allocates unbounded memory when compiling large comma-separated selector lists, allowing an attacker to cause denial of service by supplying a crafted selector string to soupsieve.compile() or Beautiful Soup .select() / .select_one(). This issue is fixed in ve [truncated]
