[pkg-vuln] CVE-2026-4539 in pygments@2.19.2 #329

New Issue

kert · 2026-04-02T17:37:21Z

kert commented

2026-04-02 17:37:21 +00:00

Severity: LOW
Package: pygments @ 2.19.2
Fixed in: 2.20.0

A security flaw has been discovered in pygments up to 2.19.2. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular expression complexity. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-4539

**Severity:** LOW **Package:** `pygments` @ `2.19.2` **Fixed in:** `2.20.0` A security flaw has been discovered in pygments up to 2.19.2. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular expression complexity. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet. **Reference:** https://nvd.nist.gov/vuln/detail/CVE-2026-4539

kert added this to the P21: Package Supply Chain — inventory, mirrors, drift, vuln scanning milestone 2026-04-02 17:37:21 +00:00

kert added the quality ci labels 2026-04-02 17:37:21 +00:00

kert closed this issue

2026-04-10 00:57:10 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: homelab/stack#329