PyPI/pymdown-extensions CVE-2026-46338: medium 4.3, EPSS 0.40%

Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path

Action: Upgrade pymdown-extensions to 10.21.3 or later.

pip install pymdown-extensions==10.21.3

Affected

Fixed versions

Sources

• osv: GHSA-62q4-447f-wv8h
• https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-62q4-447f-wv8h
• https://github.com/facelessuser/pymdown-extensions/pull/2039
• https://github.com/facelessuser/pymdown-extensions

CVE-2026-46338 · published 2026-05-19T20:00:29Z · modified 2026-09-10T03:50:45.703936995Z · JSON