CVE-2026-46338

Name	CVE-2026-46338
Description	PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containment check in SnippetPreprocessor.get_snippet_path() in pymdownx/snippets.py when `restrict_base_path: True`, allowing markdown snippet directives to read files from sibling paths that share the same base_path prefix, such as docs and docs_internal. This is a regression of CVE-2023-32309. This issue is fixed in version 10.21.3.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
pymdown-extensions (PTS)	bookworm	9.5-2	vulnerable
	trixie	10.13-1+deb13u1	vulnerable
	forky, sid	11.0.1-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
pymdown-extensions	source	(unstable)	11.0.1-1

Notes

[trixie] - pymdown-extensions <no-dsa> (Minor issue)
https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-62q4-447f-wv8h
Fixed by: https://github.com/facelessuser/pymdown-extensions/commit/63b7835776d703d6c339cf2110d9888f676efc0c (10.21.3)