Facelessuser vulnerabilities

Products

• Pymdown-extensions 5
• Soupsieve 4
• Pymdown Extensions 3
• Soup Sieve 2

Newest

• facelessuser soupsieve Soup Sieve: Polynomial-time ReDoS (O(n²)) in the whitespace/comment trimming regex `RE_WS_END` (triggers on VALID selectors) CVE-2026-85999 Fix available 5.3 MediumSeptember 17, 2026
• facelessuser soupsieve Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patterns CVE-2026-86000 Fix available 5.3 MediumSeptember 17, 2026
• facelessuser pymdown-extensions pymdown-extensions: Exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processors CVE-2026-67422 Fix available 7.5 HighAugust 6, 2026
• facelessuser pymdown-extensions PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path CVE-2026-61632 Fix available 5.3 MediumJuly 24, 2026
• facelessuser soup sieve, soupsieve +1 more Soup Sieve: Regular Expression Denial of Service (ReDoS) in soupsieve Selector Parser CVE-2026-49477 Fix available 7.5 HighJuly 9, 2026
• facelessuser soup sieve, soupsieve +1 more Soup Sieve: Memory Exhaustion via Large Comma-Separated Selector Lists in soupsieve CVE-2026-49476 Fix available 7.5 HighJuly 9, 2026
• facelessuser pymdown extensions, pymdown-extensions +1 more PyMdown Extensions: Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path CVE-2026-46338 Fix available 4.3 MediumMay 19, 2026
• facelessuser pymdown extensions, pymdown-extensions +1 more PyMdown Extensions has ReDOS bug in Figure Capture extension CVE-2025-68142 Fix available 2.7 LowDecember 16, 2025
• facelessuser pymdown extensions, pymdown-extensions +1 more Arbitrary file inclusion with the pymdowm-snippets extension CVE-2023-32309 Public exploitFix available 7.5 HighMay 15, 2023