diff --git a/pkgs/development/python-modules/pymdown-extensions/default.nix b/pkgs/development/python-modules/pymdown-extensions/default.nix
index 7ba31d5ed9ab..a359e408c86e 100644
--- a/pkgs/development/python-modules/pymdown-extensions/default.nix
+++ b/pkgs/development/python-modules/pymdown-extensions/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  fetchpatch2,
   hatchling,
   pytestCheckHook,
   markdown,
@@ -45,16 +46,35 @@ let
 in
 buildPythonPackage rec {
   pname = "pymdown-extensions";
-  version = "10.21.2";
+  version = "10.21.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "facelessuser";
     repo = "pymdown-extensions";
     tag = version;
-    hash = "sha256-BKnrq8m+xQYZs6V+x+3al7yS8531UvvaC4V+ny+f+Qg=";
+    hash = "sha256-hu9fXjZxlris3AhPS7bz3kcSyQtSeh0B6ZAZBsCO4+g=";
   };
 
+  patches = [
+    # Remove when updating to 11.0.0 or later.
+    (fetchpatch2 {
+      name = "CVE-2026-61632.patch";
+      url = "https://github.com/facelessuser/pymdown-extensions/commit/edce35586d11a1ef78bb187bc60497fe6dbf3b64.patch?full_index=1";
+      hash = "sha256-0J/ruQG73Lku/z+lFnb8XWT5WK+psiJyHq3/3ezUY8k=";
+    })
+    # Remove when updating to 11.0.1 or later.
+    (fetchpatch2 {
+      name = "CVE-2026-67422.patch";
+      url = "https://github.com/facelessuser/pymdown-extensions/commit/c68498598d7b13011bb4571350b6e3612a4ce44b.patch?full_index=1";
+      excludes = [
+        "docs/src/markdown/about/changelog.md"
+        "pymdownx/__meta__.py"
+      ];
+      hash = "sha256-r69jhMjTR/1oeSLifjZzG+wXYceSlkUk0KIPsGkOi1E=";
+    })
+  ];
+
   build-system = [ hatchling ];
 
   dependencies = [