CVE-2026-4539

pygments archetype.py AdlLexer redos

CVSS 4.8 MEDIUMEPSS 0.2%CWE-1333 CWE-400

Vexday Risk Score

13Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 4.8EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

22 mar 2026Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

A security flaw has been discovered in pygments up to 2.19.2. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular expression complexity. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

Produtos afetados

n/a · pygments

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://github.com/pygments/pygments/https://github.com/pygments/pygments/issues/3058 https://vuldb.com/?ctiid.352327 https://vuldb.com/?id.352327 https://vuldb.com/?submit.774685