{"action":"Upgrade pygments to 2.20.0 or later.","affected":[{"fixed":"2.20.0","introduced":"0"}],"component":"pygments","cve_ids":["CVE-2026-4539"],"ecosystem":"PyPI","epss":0.00159,"exploited":false,"fixed_versions":["2.20.0"],"ghsa_id":"GHSA-5239-wwwm-4pmq","id":"tcs_01M5KEZH43KG229D5CMCVF89GD","modified_at":"2026-09-10T03:50:59.780634752Z","published_at":"2026-03-22T06:30:15Z","references":["https://osv.dev/vulnerability/GHSA-5239-wwwm-4pmq","https://nvd.nist.gov/vuln/detail/CVE-2026-4539","https://github.com/pygments/pygments/issues/3058","https://github.com/pygments/pygments/pull/3064","https://github.com/pygments/pygments/commit/24b8aa76c6cd6d70f39c6dd605cce319c98e2ccc","https://github.com/pygments/pygments","https://github.com/pygments/pygments/releases/tag/2.20.0","https://vuldb.com/?ctiid.352327","https://vuldb.com/?id.352327","https://vuldb.com/?submit.774685"],"severity":{"label":"low","score":3.3},"sources":[{"source":"osv","source_id":"GHSA-5239-wwwm-4pmq","url":"https://osv.dev/vulnerability/GHSA-5239-wwwm-4pmq"}],"summary":"Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching"}