PyPI/pymdown-extensions CVE-2026-46338: medium 4.3, EPSS 0.40%

Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path

Action: Upgrade pymdown-extensions to 10.21.3 or later.

pip install pymdown-extensions==10.21.3

Affected

Fixed versions

Sources

• osv: PYSEC-2026-2999
• https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-62q4-447f-wv8h
• https://github.com/facelessuser/pymdown-extensions/pull/2039
• https://github.com/facelessuser/pymdown-extensions
• https://pypi.org/project/pymdown-extensions
• https://github.com/advisories/GHSA-62q4-447f-wv8h
• https://nvd.nist.gov/vuln/detail/CVE-2026-46338

CVE-2026-46338 · published 2026-07-13T15:19:09.231055Z · modified 2026-07-13T16:33:07.759730233Z · JSON