Medium 4.3Published Jul 16, 2026

CVE-2026-46338PyMdown Extensions: Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path

Updated under an hour ago (Oct 27, 2026, 3:30 PM ET)

Does this affect you?

It affects facelessuser pymdown-extensions. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for facelessuser pymdown-extensions

Exploited in the last 30 days

PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containment check in SnippetPreprocessor.get_snippet_path() in pymdownx/snippets.py when `restrict_base_path: True`, allowing markdown snippet directives to read files from sibling paths that share the same base_path prefix, such as docs and docs_internal. This is a regression of CVE-2023-32309. This issue is fixed in version 10.21.3.

CVSS: 4.3 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Weakness (CWE): CWE-22
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: GitHub_M
NVD analysis: Analyzed
Record last updated: Jul 17, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

facelessuser pymdown-extensions facelessuser:pymdown_extensions (from the name)	from 10.0.1, < 10.21.3	CNA record
facelessuser pymdown_extensions facelessuser:pymdown_extensions	from 10.0.1 before 10.21.3	NVD

References

References

https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-62q4-447f-wv8h	x-refsource-confirm, exploit, mitigation, vendor-advisory
https://github.com/facelessuser/pymdown-extensions/commit/63b7835776d703d6c339cf2110d9888f676efc0c	x-refsource-misc, patch
https://github.com/facelessuser/pymdown-extensions/releases/tag/10.21.3	x-refsource-misc, product, release-notes

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.