PyPI/pymdown-extensions CVE-2023-32309: high 7.5, EPSS 1.66%

Any file can be included with the pymdown-snippets extension

Action: Upgrade pymdown-extensions to 10.0 or later.

pip install pymdown-extensions==10.0

Affected

Fixed versions

Sources

• osv: GHSA-jh85-wwv9-24hv
• https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-jh85-wwv9-24hv
• https://nvd.nist.gov/vuln/detail/CVE-2023-32309
• https://github.com/facelessuser/pymdown-extensions/commit/b7bb4878d6017c03c8dc97c42d8d3bb6ee81db9d
• https://github.com/facelessuser/pymdown-extensions
• https://github.com/facelessuser/pymdown-extensions/releases/tag/10.0

CVE-2023-32309 · published 2023-05-15T20:50:23Z · modified 2026-07-07T17:57:16.702920365Z · JSON