CVE-2026-46338
Medium
Description
PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containment check in SnippetPreprocessor.get_snippet_path() in pymdownx/snippets.py when `restrict_base_path: True`, allowing markdown snippet directives to read files from sibling paths that share the same base_path prefix, such as docs and docs_internal. This is a regression of CVE-2023-32309. This issue is fixed in version 10.21.3.
SeverityMedium
CVSS4.3
Exploit probability—
ProductFacelessuser Pymdown Extensions
PublishedJul 16, 2026
First seenJul 16, 2026
Weakness typeCWE-22Path traversal
How to fix
Update
- facelessuser pymdown_extensions10.21.3 or later
- pymdown-extensions10.21.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| facelessuser pymdown_extensions | 10.0.1 ≤ v < 10.21.3 | 10.21.3 |
| pymdown-extensionsPyPI | 10.0.1 ≤ v < 10.21.3 | 10.21.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.