CVE-2026-46338

MediumCVSS 4.3/10Last modified Oct 24, 2026

Description

PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containment check in SnippetPreprocessor.get_snippet_path() in pymdownx/snippets.py when `restrict_base_path: True`, allowing markdown snippet directives to read files from sibling paths that share the same base_path prefix, such as docs and docs_internal. This is a regression of CVE-2023-32309. This issue is fixed in version 10.21.3.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
facelessuser	pymdown-extensions	>= 10.0.1, < 10.21.3

References

https://github.com/facelessuser/pymdown-extensions/commit/63b7835776d703d6c339cf2110d9888f676efc0cPatch
https://github.com/facelessuser/pymdown-extensions/releases/tag/10.21.3Product, Release Notes
https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-62q4-447f-wv8hExploit, Mitigation, Vendor Advisory
https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-62q4-447f-wv8hExploit, Mitigation, Vendor Advisory

Timeline

Published: Jul 16, 2026
Last modified: Oct 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-4633910.09Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js middleware did not protect /api/cli-tools/* and /api CVE-2026-46347.5A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an CVE-2026-463407.5Netty is a network application framework for development of protocol servers and clients. In versions of netty-transport-sctp prior to 4.1.1 CVE-2026-463416.1The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on CVE-2026-463425.4Nuxt is an open-source web development framework for Vue.js. In Nuxt versions 3.1.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6 and @CVE-2026-463437.2Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, Wazuh CVE-2026-463445.3liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. Prior to 0.16.0, an out-CVE-2026-463458.4compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the `-o/--output` argument in CVE-2026-463466.5The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the password CVE-2026-463476.8The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, when a passwo CVE-2026-463488.7Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.10, 4.4.17, and 4.3.23, the list of disallowed IP a CVE-2026-463495.3Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.10, 4.4.17, and 4.3.23, Mastodon's normalization of