Is pygments safe ? 5 known vulnerabilities, worst severity CRITICAL.
// reach 1 direct dependencies
none carry a known advisory
301 packages depend on it
an advisory here reaches each of them
// ai model usage No published models are known to use this package.
cvss CVSS v3.0 base score out of 10
epss chance of exploitation in 30 days, 94th percentile of all CVEs
xyz score CyberXYZ composite out of 10
fig. 01 — GHSA-fff8-4w9p-7v76, the advisory selected below
// 5 advisories GHSA-fff8-4w9p-7v76 The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name. CRIT GHSA-9w8r-397f-prfh An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source file, as demonstrated by input that only contains the "exception" keyword. HIGH GHSA-pq64-v7f5-gqh8 In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have exponential or cubic worst-case complexity and are vulnerable to ReDoS. By crafting malicious input, an attacker can cause a denial of service. HIGH GHSA-mrwq-x4v8-fh7p A ReDoS issue was discovered in pygments/lexers/smithy.py in Pygments until 2.15.0 via SmithyLexer. MODE GHSA-5239-wwwm-4pmq A security flaw has been discovered in pygments before 2.20.0. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular expression complexity. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an i LOW The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name.
// cvss v3.0 vector CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Scope Changed
Confidentiality High
Integrity High
Availability High Checked 2026-11-07 at 10:27 UTC. The most recent advisory here was published 2026-03-22. Updated continuously from NVD, GHSA, OSV and CNA feeds.
Think a verdict here is wrong? Tell us — we respond within 2 business days. Report an issue with this page