Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:pypi/pygments@2.20.0
purl pkg:pypi/pygments@2.20.0
Vulnerabilities affecting this package (0)
Vulnerability Summary Fixed by
This package is not known to be affected by vulnerabilities.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-3kfv-bmqf-aqhv Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching A security flaw has been discovered in pygments before 2.20.0. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular expression complexity. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet. CVE-2026-4539
GHSA-5239-wwwm-4pmq

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-23T09:03:17.163444+00:00 GitLab Importer Fixing VCID-3kfv-bmqf-aqhv https://gitlab.com/gitlab-org/advisories-community/-/blob/main/pypi/Pygments/CVE-2026-4539.yml 38.4.0
2026-04-02T17:01:19.794304+00:00 GHSA Importer Fixing VCID-3kfv-bmqf-aqhv https://github.com/advisories/GHSA-5239-wwwm-4pmq 38.1.0
2026-04-01T12:53:33.188966+00:00 GithubOSV Importer Fixing VCID-3kfv-bmqf-aqhv https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-5239-wwwm-4pmq/GHSA-5239-wwwm-4pmq.json 38.0.0