Vulnerability Description
PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containment check in SnippetPreprocessor.get_snippet_path() in pymdownx/snippets.py when `restrict_base_path: True`, allowing markdown snippet directives to read files from sibling paths that share the same base_path prefix, such as docs and docs_internal. This is a regression of CVE-2023-32309. This issue is fixed in version 10.21.3.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Facelessuser | Pymdown Extensions | >= 10.0.1, < 10.21.3 |
Related Weaknesses (CWE)
References
- https://github.com/facelessuser/pymdown-extensions/commit/63b7835776d703d6c339cfPatch
- https://github.com/facelessuser/pymdown-extensions/releases/tag/10.21.3ProductRelease Notes
- https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-62q4ExploitMitigationVendor Advisory
- https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-62q4ExploitMitigationVendor Advisory
FAQ
What is CVE-2026-46338?
CVE-2026-46338 is a vulnerability with a CVSS score of 4.3 (MEDIUM). PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containment check in SnippetPreprocessor.get_snipp...
How severe is CVE-2026-46338?
CVE-2026-46338 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-46338?
Check the references section above for vendor advisories and patch information. Affected products include: Facelessuser Pymdown Extensions.