Vulnerability Details CVE-2026-46338
PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containment check in SnippetPreprocessor.get_snippet_path() in pymdownx/snippets.py when `restrict_base_path: True`, allowing markdown snippet directives to read files from sibling paths that share the same base_path prefix, such as docs and docs_internal. This is a regression of CVE-2023-32309. This issue is fixed in version 10.21.3.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 17.5%
CVSS Severity
CVSS v3 Score 4.3
References
- https://github.com/facelessuser/pymdown-extensions/commit/63b7835776d703d6c339cf2110d9888f676efc0c
- https://github.com/facelessuser/pymdown-extensions/releases/tag/10.21.3
- https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-62q4-447f-wv8h
- https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-62q4-447f-wv8h
Products affected by CVE-2026-46338
-
cpe:2.3:a:facelessuser:pymdown_extensions:10.0.1
-
cpe:2.3:a:facelessuser:pymdown_extensions:10.1
-
cpe:2.3:a:facelessuser:pymdown_extensions:10.10
-
cpe:2.3:a:facelessuser:pymdown_extensions:10.10.1
-
cpe:2.3:a:facelessuser:pymdown_extensions:10.10.2
-
cpe:2.3:a:facelessuser:pymdown_extensions:10.11
-
cpe:2.3:a:facelessuser:pymdown_extensions:10.11.1
-
cpe:2.3:a:facelessuser:pymdown_extensions:10.11.2
-
cpe:2.3:a:facelessuser:pymdown_extensions:10.12
-
cpe:2.3:a:facelessuser:pymdown_extensions:10.13
-
cpe:2.3:a:facelessuser:pymdown_extensions:10.14
-
cpe:2.3:a:facelessuser:pymdown_extensions:10.14.1
-
cpe:2.3:a:facelessuser:pymdown_extensions:10.14.2
-
cpe:2.3:a:facelessuser:pymdown_extensions:10.14.3
-
cpe:2.3:a:facelessuser:pymdown_extensions:10.15
-
cpe:2.3:a:facelessuser:pymdown_extensions:10.16
-
cpe:2.3:a:facelessuser:pymdown_extensions:10.16.1
-
cpe:2.3:a:facelessuser:pymdown_extensions:10.17
-
cpe:2.3:a:facelessuser:pymdown_extensions:10.17.1
-
cpe:2.3:a:facelessuser:pymdown_extensions:10.17.2
-
cpe:2.3:a:facelessuser:pymdown_extensions:10.18
-
cpe:2.3:a:facelessuser:pymdown_extensions:10.19
-
cpe:2.3:a:facelessuser:pymdown_extensions:10.19.1
-
cpe:2.3:a:facelessuser:pymdown_extensions:10.2
-
cpe:2.3:a:facelessuser:pymdown_extensions:10.2.1
-
cpe:2.3:a:facelessuser:pymdown_extensions:10.20
-
cpe:2.3:a:facelessuser:pymdown_extensions:10.20.1
-
cpe:2.3:a:facelessuser:pymdown_extensions:10.21
-
cpe:2.3:a:facelessuser:pymdown_extensions:10.21.1
-
cpe:2.3:a:facelessuser:pymdown_extensions:10.21.2
-
cpe:2.3:a:facelessuser:pymdown_extensions:10.3
-
cpe:2.3:a:facelessuser:pymdown_extensions:10.3.1
-
cpe:2.3:a:facelessuser:pymdown_extensions:10.4
-
cpe:2.3:a:facelessuser:pymdown_extensions:10.5
-
cpe:2.3:a:facelessuser:pymdown_extensions:10.6
-
cpe:2.3:a:facelessuser:pymdown_extensions:10.7
-
cpe:2.3:a:facelessuser:pymdown_extensions:10.7.1
-
cpe:2.3:a:facelessuser:pymdown_extensions:10.8
-
cpe:2.3:a:facelessuser:pymdown_extensions:10.8.1
-
cpe:2.3:a:facelessuser:pymdown_extensions:10.9