The vulnerability originates from the caret, tilde, betterem, and magiclink inline processors in pymdown-extensions, where the regular expressions allow exponential numbers of partitionings for runs of delimiters. This leads to catastrophic backtracking when a short, untrusted Markdown line is rendered, causing the rendering thread to consume unbounded CPU time proportional to the input length. The flaw is exploitable by an unauthenticated remote attacker who can submit Markdown through any interface that invokes markdown.markdown(), resulting in denial of service.

Affected are all releases of pymdown-extensions up to and including version 11.0. Any application that uses these vulnerable processors, such as web sites, forums, wikis, issue trackers, or content management systems that render user‑supplied Markdown, is susceptible. Applications that include the bundled pymdownx.extra extension—which incorporates the vulnerable betterem default—share the same risk. Hosted documentation and continuous‑integration systems that build untrusted Markdown files are also exposed.

The CVSS score of 7.5 classifies the issue as High severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the exploitation requires only the ability to supply Markdown via a public endpoint and does not need elevated privileges, the attack vector is unauthenticated remote. Given the potential for uncontrolled CPU consumption on the server, the risk is significant, especially in high‑traffic or resource‑constrained environments.