CVE-2026-46338 | BDVDB-2026-348944 Detail

Description#

PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containment check in SnippetPreprocessor.get_snippet_path() in pymdownx/snippets.py when `restrict_base_path: True`, allowing markdown snippet directives to read files from sibling paths that share the same base_path prefix, such as docs and docs_internal. This is a regression of CVE-2023-32309. This issue is fixed in version 10.21.3.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-07-16Record published in the CVE List.
2. Version 22026-07-17Most recent update recorded in the CVE List.