MEDIUM4.3PyPI
GHSA-62q4-447f-wv8h· CVE-2026-46338, PYSEC-2026-2999Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path
Modified: 9/10/2026
package
PyPI/pymdown-extensions
pkg:pypi/pymdown-extensions
MEDIUM5.3PyPI
GHSA-9xwg-3r6f-jcx2· CVE-2026-61632, PYSEC-2026-3609PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path
Modified: 9/10/2026
HIGH7.5PyPI
GHSA-gm37-52c6-37mw· CVE-2026-67422, PYSEC-2026-3654pymdown-extensions: exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processors
Modified: 9/10/2026
HIGH7.5PyPI
GHSA-jh85-wwv9-24hv· CVE-2023-32309, PYSEC-2026-1824Any file can be included with the pymdown-snippets extension
Modified: 7/7/2026
LOWPyPI
GHSA-r6h4-mm7h-8pmq· CVE-2025-68142, PYSEC-2026-1825PyMdown Extensions has a ReDOS bug in its Figure Capture extension
Modified: 7/7/2026
HIGH7.5PyPI
PYSEC-2026-1824· CVE-2023-32309, GHSA-jh85-wwv9-24hvAny file can be included with the pymdown-snippets extension
Modified: 7/7/2026
—PyPI
PYSEC-2026-1825· CVE-2025-68142, GHSA-r6h4-mm7h-8pmqPyMdown Extensions has a ReDOS bug in its Figure Capture extension
Modified: 7/7/2026
MEDIUM4.3PyPI
PYSEC-2026-2999· CVE-2026-46338, GHSA-62q4-447f-wv8hRegression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path
Modified: 7/13/2026
MEDIUM5.3PyPI
PYSEC-2026-3609· CVE-2026-61632, GHSA-9xwg-3r6f-jcx2PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path
Modified: 8/4/2026
HIGH7.5PyPI
PYSEC-2026-3654· CVE-2026-67422, GHSA-gm37-52c6-37mwpymdown-extensions: exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processors
Modified: 8/10/2026