Vulnerable Library - mkdocs_material-9.7.6-py3-none-any.whl
Path to dependency file: /docs/Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/docs-1AIbruy1-python/lib/python3.11/site-packages/pymdown_extensions-10.21.dist-info
Found in HEAD commit: 446042fbc4c58f55308d90dae1762e64bf13a474
Vulnerabilities
| Vulnerability |
Severity |
 CVSS |
Dependency |
Type |
Fixed in (mkdocs_material version) |
Remediation Possible** |
| CVE-2026-44432 |
 High |
8.6 |
urllib3-2.6.3-py3-none-any.whl |
Transitive |
N/A* |
❌ |
| CVE-2026-44431 |
 Medium |
5.9 |
urllib3-2.6.3-py3-none-any.whl |
Transitive |
N/A* |
❌ |
| CVE-2026-45409 |
Medium |
5.3 |
idna-3.11-py3-none-any.whl |
Transitive |
N/A* |
❌ |
| CVE-2026-46338 |
Medium |
4.3 |
pymdown_extensions-10.21-py3-none-any.whl |
Transitive |
N/A* |
❌ |
| CVE-2026-4539 |
 Low |
3.3 |
pygments-2.19.2-py3-none-any.whl |
Transitive |
N/A* |
❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2026-44432
Vulnerable Library - urllib3-2.6.3-py3-none-any.whl
HTTP library with thread-safe connection pooling, file post, and more.
Library home page: https://files.pythonhosted.org/packages/39/08/aaaad47bc4e9dc8c725e68f9d04865dbcb2052843ff09c97b08904852d84/urllib3-2.6.3-py3-none-any.whl
Path to dependency file: /docs/Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/docs-1AIbruy1-python/lib/python3.11/site-packages/urllib3-2.6.3.dist-info
Dependency Hierarchy:
- mkdocs_material-9.7.6-py3-none-any.whl (Root Library)
- requests-2.33.0-py3-none-any.whl
- ❌ urllib3-2.6.3-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 446042fbc4c58f55308d90dae1762e64bf13a474
Found in base branch: develop
Vulnerability Details
urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Brotli library or (2) when HTTPResponse.drain_conn() was called after the response had been read and decompressed partially (compression algorithm did not matter here). These issues could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This could result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data) on the client side. This vulnerability is fixed in 2.7.0.
Publish Date: 2026-05-13
URL: CVE-2026-44432
CVSS 3 Score Details (8.6)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-mf9v-mfxr-j63j
Release Date: 2026-05-11
Fix Resolution: urllib3 - 2.7.0,urllib3 - 2.7.0
CVE-2026-44431
Vulnerable Library - urllib3-2.6.3-py3-none-any.whl
HTTP library with thread-safe connection pooling, file post, and more.
Library home page: https://files.pythonhosted.org/packages/39/08/aaaad47bc4e9dc8c725e68f9d04865dbcb2052843ff09c97b08904852d84/urllib3-2.6.3-py3-none-any.whl
Path to dependency file: /docs/Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/docs-1AIbruy1-python/lib/python3.11/site-packages/urllib3-2.6.3.dist-info
Dependency Hierarchy:
- mkdocs_material-9.7.6-py3-none-any.whl (Root Library)
- requests-2.33.0-py3-none-any.whl
- ❌ urllib3-2.6.3-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 446042fbc4c58f55308d90dae1762e64bf13a474
Found in base branch: develop
Vulnerability Details
urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.
Publish Date: 2026-05-13
URL: CVE-2026-44431
CVSS 3 Score Details (5.9)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-qccp-gfcp-xxvc
Release Date: 2026-05-11
Fix Resolution: urllib3 - 2.7.0,urllib3 - 2.7.0
CVE-2026-45409
Vulnerable Library - idna-3.11-py3-none-any.whl
Internationalized Domain Names in Applications (IDNA)
Library home page: https://files.pythonhosted.org/packages/0e/61/66938bbb5fc52dbdf84594873d5b51fb1f7c7794e9c0f5bd885f30bc507b/idna-3.11-py3-none-any.whl
Path to dependency file: /docs/Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/docs-1AIbruy1-python/lib/python3.11/site-packages/idna-3.11.dist-info
Dependency Hierarchy:
- mkdocs_material-9.7.6-py3-none-any.whl (Root Library)
- requests-2.33.0-py3-none-any.whl
- ❌ idna-3.11-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 446042fbc4c58f55308d90dae1762e64bf13a474
Found in base branch: develop
Vulnerability Details
This is the same issue as CVE-2024-3651, however the original remediation in 2024 was not a complete fix. Payloads such as ""\u0660" * N" or ""\u30fb" * N + "\u6f22"" utilize the "valid_contexto" function prior to length rejection, and for high values of "N" will take a long time to process. Impact A specially crafted argument to the "idna.encode()" function could consume significant resources. This may lead to a denial-of-service. Patches Starting in version 3.14, the function rejects long inputs as soon as practicable prior to any further processing to minimize resource consumption. In version 3.15, this approach was extended to lesser used alternate functions (i.e. per-label conversions and codec support). Workarounds Domain names cannot exceed 253 characters in length, if this length limit is enforced prior to passing the domain to the "idna.encode()" function it should no longer consume significant resources. This is triggered by arbitrarily large inputs that would not occur in normal usage, but may be passed to the library assuming there is no preliminary input validation by the higher-level application.
Publish Date: 2026-05-19
URL: CVE-2026-45409
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-65pc-fj4g-8rjx
Release Date: 2026-05-19
Fix Resolution: idna - 3.15
CVE-2026-46338
Vulnerable Library - pymdown_extensions-10.21-py3-none-any.whl
Extension pack for Python Markdown.
Library home page: https://files.pythonhosted.org/packages/6f/2c/5b079febdc65e1c3fb2729bf958d18b45be7113828528e8a0b5850dd819a/pymdown_extensions-10.21-py3-none-any.whl
Path to dependency file: /docs/Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/docs-1AIbruy1-python/lib/python3.11/site-packages/pymdown_extensions-10.21.dist-info
Dependency Hierarchy:
- mkdocs_material-9.7.6-py3-none-any.whl (Root Library)
- ❌ pymdown_extensions-10.21-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 446042fbc4c58f55308d90dae1762e64bf13a474
Found in base branch: develop
Vulnerability Details
Summary "pymdownx.snippets" has a regression of the CVE-2023-32309 / GHSA-jh85-wwv9-24hv fix. With "restrict_base_path: True" (the default), the current "filename.startswith(base)" containment check does not enforce a directory boundary. As a result, a markdown snippet directive can read files from sibling paths that share the same prefix as "base_path", such as "docs" vs "docs_internal". The regression was introduced in PR #2039 / commit "7c13bda5b7793b172efd1abb6712e156a83fe07d", which replaced the original directory-identity check with a plain string-prefix comparison. Details The regression was introduced in commit "7c13bda5b7793b172efd1abb6712e156a83fe07d" (2023-05-15, #2039 "Fix regression of snippets nested deeply under specified base path"), which relaxed the original "os.path.samefile(base, os.path.dirname(filename))" check to a plain "startswith(base)". "SnippetPreprocessor.get_snippet_path()" in "pymdownx/snippets.py": if self.restrict_base_path: filename = os.path.abspath(os.path.join(base, path)) # If the absolute path is no longer under the specified base path, reject the file if not filename.startswith(base): continue "base" is "os.path.abspath(b)" and has no trailing separator. "str.startswith(base)" is "True" for any "filename" whose string representation begins with the same characters as "base", regardless of whether those characters end at a directory boundary. Concrete example: * "base = "/x/docs"" * "path = "../docs_secret/leak.txt"" (inside the markdown snippet directive) * "os.path.join(base, path)" → ""/x/docs/../docs_secret/leak.txt"" * "os.path.abspath(...)" → ""/x/docs_secret/leak.txt"" * "filename.startswith(base)" → "True", because ""/x/docs_secret/..."" begins with the literal string ""/x/docs"". All releases from 10.0.1 (2023-05-15) through 10.21.2 (current) are affected. Impact Arbitrary file read within the host the build runs on, bounded by the prefix match. With "base_path = /x/docs" the attacker can read files from any sibling directory whose path begins with the literal string "/x/docs" followed by any non-separator character — for example "/x/docs_internal/", "/x/docs.bak/", "/x/docs2/". The threat model is the same as the original CVE-2023-32309: markdown content processed by the snippets preprocessor in a build pipeline (typical scenario: an MkDocs documentation site built in CI from PR contributions or otherwise less-trusted markdown) can read files outside the configured base. CI builds that publish the generated HTML expose the read file to the public; CI builds with secrets on disk leak those secrets. Reproduction Minimal local PoC, non-destructive: import os, shutil, tempfile, markdown work = tempfile.mkdtemp(prefix="pmx_poc_") try: base = os.path.join(work, "docs") sibling = os.path.join(work, "docs_secret") os.makedirs(base) os.makedirs(sibling) with open(os.path.join(sibling, "leak.txt"), "w") as f: f.write("TOP_SECRET_FROM_SIBLING_DIR\n") out = markdown.markdown( '--8<-- "../docs_secret/leak.txt"\n', extensions=["pymdownx.snippets"], extension_configs={ "pymdownx.snippets": { "base_path": [base], "restrict_base_path": True, "check_paths": True, } }, ) print(out) # ->
TOP_SECRET_FROM_SIBLING_DIR
finally: shutil.rmtree(work) Default "restrict_base_path: True" is sufficient — no non-default option is required. Suggested fix Minimal change — require the separator after the base prefix: - if not filename.startswith(base): + # Append os.sep so a sibling directory whose name shares a prefix + # (e.g. /x/docs vs /x/docs_evil) cannot satisfy the check. + if not filename.startswith(base + os.sep): continue This preserves the original intent (allow snippets nested at any depth under "base_path") while restoring the directory-boundary check. It does not affect the "os.path.isdir(base)" branch where "base" is a file (that branch still uses "os.path.samefile"). Alternative: "os.path.commonpath([base, filename]) == base" is equivalent and slightly more idiomatic, though it raises "ValueError" on different drives on Windows and would need a "try/except". The "startswith(base + os.sep)" fix is the smaller diff. Note: this fix does not change behaviour for symlinks inside "base_path". The existing implementation uses "os.path.abspath" (not "os.path.realpath"), so a symlink within "base_path" pointing outside is still followed. That is a separate concern — symlinks require write access to "base_path", a much higher bar than the current bypass — and matches the behaviour the CVE-2023 fix established. Regression test A regression test class "TestSnippetsSiblingPrefix" was added in "tests/test_extensions/test_snippets.py". It uses "tests/test_extensions/_snippets/nested" as "base_path" and a new fixture directory "tests/test_extensions/_snippets/nested_sibling_evil/leak.txt". It asserts that the markdown directive "--8<-- "../nested_sibling_evil/leak.txt"" raises "SnippetMissingError". * Without fix: test fails ("AssertionError: SnippetMissingError not raised", sibling file is silently read). * With fix: test passes. Full suite: "python -m pytest tests/ -q" → 738 passed (737 baseline + 1 new regression test). No regressions. Affected versions ">= 10.0.1, <= 10.21.2"
Publish Date: 2026-05-20
URL: CVE-2026-46338
CVSS 3 Score Details (4.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-62q4-447f-wv8h
Release Date: 2026-05-20
Fix Resolution: pymdown-extensions - 10.21.3
CVE-2026-4539
Vulnerable Library - pygments-2.19.2-py3-none-any.whl
Pygments is a syntax highlighting package written in Python.
Library home page: https://files.pythonhosted.org/packages/c7/21/705964c7812476f378728bdf590ca4b771ec72385c533964653c68e86bdc/pygments-2.19.2-py3-none-any.whl
Path to dependency file: /docs/Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/docs-1AIbruy1-python/lib/python3.11/site-packages/pygments-2.19.2.dist-info
Dependency Hierarchy:
- mkdocs_material-9.7.6-py3-none-any.whl (Root Library)
- ❌ pygments-2.19.2-py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 446042fbc4c58f55308d90dae1762e64bf13a474
Found in base branch: develop
Vulnerability Details
A security flaw has been discovered in pygments up to 2.19.2. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular expression complexity. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Publish Date: 2026-03-22
URL: CVE-2026-4539
CVSS 3 Score Details (3.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-5239-wwwm-4pmq
Release Date: 2026-03-22
Fix Resolution: pygments - 2.20.0
Path to dependency file: /docs/Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/docs-1AIbruy1-python/lib/python3.11/site-packages/pymdown_extensions-10.21.dist-info
Found in HEAD commit: 446042fbc4c58f55308d90dae1762e64bf13a474
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Vulnerable Library - urllib3-2.6.3-py3-none-any.whl
HTTP library with thread-safe connection pooling, file post, and more.
Library home page: https://files.pythonhosted.org/packages/39/08/aaaad47bc4e9dc8c725e68f9d04865dbcb2052843ff09c97b08904852d84/urllib3-2.6.3-py3-none-any.whl
Path to dependency file: /docs/Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/docs-1AIbruy1-python/lib/python3.11/site-packages/urllib3-2.6.3.dist-info
Dependency Hierarchy:
Found in HEAD commit: 446042fbc4c58f55308d90dae1762e64bf13a474
Found in base branch: develop
Vulnerability Details
urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Brotli library or (2) when HTTPResponse.drain_conn() was called after the response had been read and decompressed partially (compression algorithm did not matter here). These issues could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This could result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data) on the client side. This vulnerability is fixed in 2.7.0.
Publish Date: 2026-05-13
URL: CVE-2026-44432
CVSS 3 Score Details (8.6)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-mf9v-mfxr-j63j
Release Date: 2026-05-11
Fix Resolution: urllib3 - 2.7.0,urllib3 - 2.7.0
Vulnerable Library - urllib3-2.6.3-py3-none-any.whl
HTTP library with thread-safe connection pooling, file post, and more.
Library home page: https://files.pythonhosted.org/packages/39/08/aaaad47bc4e9dc8c725e68f9d04865dbcb2052843ff09c97b08904852d84/urllib3-2.6.3-py3-none-any.whl
Path to dependency file: /docs/Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/docs-1AIbruy1-python/lib/python3.11/site-packages/urllib3-2.6.3.dist-info
Dependency Hierarchy:
Found in HEAD commit: 446042fbc4c58f55308d90dae1762e64bf13a474
Found in base branch: develop
Vulnerability Details
urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.
Publish Date: 2026-05-13
URL: CVE-2026-44431
CVSS 3 Score Details (5.9)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-qccp-gfcp-xxvc
Release Date: 2026-05-11
Fix Resolution: urllib3 - 2.7.0,urllib3 - 2.7.0
Vulnerable Library - idna-3.11-py3-none-any.whl
Internationalized Domain Names in Applications (IDNA)
Library home page: https://files.pythonhosted.org/packages/0e/61/66938bbb5fc52dbdf84594873d5b51fb1f7c7794e9c0f5bd885f30bc507b/idna-3.11-py3-none-any.whl
Path to dependency file: /docs/Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/docs-1AIbruy1-python/lib/python3.11/site-packages/idna-3.11.dist-info
Dependency Hierarchy:
Found in HEAD commit: 446042fbc4c58f55308d90dae1762e64bf13a474
Found in base branch: develop
Vulnerability Details
This is the same issue as CVE-2024-3651, however the original remediation in 2024 was not a complete fix. Payloads such as ""\u0660" * N" or ""\u30fb" * N + "\u6f22"" utilize the "valid_contexto" function prior to length rejection, and for high values of "N" will take a long time to process. Impact A specially crafted argument to the "idna.encode()" function could consume significant resources. This may lead to a denial-of-service. Patches Starting in version 3.14, the function rejects long inputs as soon as practicable prior to any further processing to minimize resource consumption. In version 3.15, this approach was extended to lesser used alternate functions (i.e. per-label conversions and codec support). Workarounds Domain names cannot exceed 253 characters in length, if this length limit is enforced prior to passing the domain to the "idna.encode()" function it should no longer consume significant resources. This is triggered by arbitrarily large inputs that would not occur in normal usage, but may be passed to the library assuming there is no preliminary input validation by the higher-level application.
Publish Date: 2026-05-19
URL: CVE-2026-45409
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-65pc-fj4g-8rjx
Release Date: 2026-05-19
Fix Resolution: idna - 3.15
Vulnerable Library - pymdown_extensions-10.21-py3-none-any.whl
Extension pack for Python Markdown.
Library home page: https://files.pythonhosted.org/packages/6f/2c/5b079febdc65e1c3fb2729bf958d18b45be7113828528e8a0b5850dd819a/pymdown_extensions-10.21-py3-none-any.whl
Path to dependency file: /docs/Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/docs-1AIbruy1-python/lib/python3.11/site-packages/pymdown_extensions-10.21.dist-info
Dependency Hierarchy:
Found in HEAD commit: 446042fbc4c58f55308d90dae1762e64bf13a474
Found in base branch: develop
Vulnerability Details
Summary "pymdownx.snippets" has a regression of the CVE-2023-32309 / GHSA-jh85-wwv9-24hv fix. With "restrict_base_path: True" (the default), the current "filename.startswith(base)" containment check does not enforce a directory boundary. As a result, a markdown snippet directive can read files from sibling paths that share the same prefix as "base_path", such as "docs" vs "docs_internal". The regression was introduced in PR #2039 / commit "7c13bda5b7793b172efd1abb6712e156a83fe07d", which replaced the original directory-identity check with a plain string-prefix comparison. Details The regression was introduced in commit "7c13bda5b7793b172efd1abb6712e156a83fe07d" (2023-05-15, #2039 "Fix regression of snippets nested deeply under specified base path"), which relaxed the original "os.path.samefile(base, os.path.dirname(filename))" check to a plain "startswith(base)". "SnippetPreprocessor.get_snippet_path()" in "pymdownx/snippets.py": if self.restrict_base_path: filename = os.path.abspath(os.path.join(base, path)) # If the absolute path is no longer under the specified base path, reject the file if not filename.startswith(base): continue "base" is "os.path.abspath(b)" and has no trailing separator. "str.startswith(base)" is "True" for any "filename" whose string representation begins with the same characters as "base", regardless of whether those characters end at a directory boundary. Concrete example: * "base = "/x/docs"" * "path = "../docs_secret/leak.txt"" (inside the markdown snippet directive) * "os.path.join(base, path)" → ""/x/docs/../docs_secret/leak.txt"" * "os.path.abspath(...)" → ""/x/docs_secret/leak.txt"" * "filename.startswith(base)" → "True", because ""/x/docs_secret/..."" begins with the literal string ""/x/docs"". All releases from 10.0.1 (2023-05-15) through 10.21.2 (current) are affected. Impact Arbitrary file read within the host the build runs on, bounded by the prefix match. With "base_path = /x/docs" the attacker can read files from any sibling directory whose path begins with the literal string "/x/docs" followed by any non-separator character — for example "/x/docs_internal/", "/x/docs.bak/", "/x/docs2/". The threat model is the same as the original CVE-2023-32309: markdown content processed by the snippets preprocessor in a build pipeline (typical scenario: an MkDocs documentation site built in CI from PR contributions or otherwise less-trusted markdown) can read files outside the configured base. CI builds that publish the generated HTML expose the read file to the public; CI builds with secrets on disk leak those secrets. Reproduction Minimal local PoC, non-destructive: import os, shutil, tempfile, markdown work = tempfile.mkdtemp(prefix="pmx_poc_") try: base = os.path.join(work, "docs") sibling = os.path.join(work, "docs_secret") os.makedirs(base) os.makedirs(sibling) with open(os.path.join(sibling, "leak.txt"), "w") as f: f.write("TOP_SECRET_FROM_SIBLING_DIR\n") out = markdown.markdown( '--8<-- "../docs_secret/leak.txt"\n', extensions=["pymdownx.snippets"], extension_configs={ "pymdownx.snippets": { "base_path": [base], "restrict_base_path": True, "check_paths": True, } }, ) print(out) # ->
TOP_SECRET_FROM_SIBLING_DIR
finally: shutil.rmtree(work) Default "restrict_base_path: True" is sufficient — no non-default option is required. Suggested fix Minimal change — require the separator after the base prefix: - if not filename.startswith(base): + # Appendos.sepso a sibling directory whose name shares a prefix + # (e.g./x/docsvs/x/docs_evil) cannot satisfy the check. + if not filename.startswith(base + os.sep): continue This preserves the original intent (allow snippets nested at any depth under "base_path") while restoring the directory-boundary check. It does not affect the "os.path.isdir(base)" branch where "base" is a file (that branch still uses "os.path.samefile"). Alternative: "os.path.commonpath([base, filename]) == base" is equivalent and slightly more idiomatic, though it raises "ValueError" on different drives on Windows and would need a "try/except". The "startswith(base + os.sep)" fix is the smaller diff. Note: this fix does not change behaviour for symlinks inside "base_path". The existing implementation uses "os.path.abspath" (not "os.path.realpath"), so a symlink within "base_path" pointing outside is still followed. That is a separate concern — symlinks require write access to "base_path", a much higher bar than the current bypass — and matches the behaviour the CVE-2023 fix established. Regression test A regression test class "TestSnippetsSiblingPrefix" was added in "tests/test_extensions/test_snippets.py". It uses "tests/test_extensions/_snippets/nested" as "base_path" and a new fixture directory "tests/test_extensions/_snippets/nested_sibling_evil/leak.txt". It asserts that the markdown directive "--8<-- "../nested_sibling_evil/leak.txt"" raises "SnippetMissingError". * Without fix: test fails ("AssertionError: SnippetMissingError not raised", sibling file is silently read). * With fix: test passes. Full suite: "python -m pytest tests/ -q" → 738 passed (737 baseline + 1 new regression test). No regressions. Affected versions ">= 10.0.1, <= 10.21.2"Publish Date: 2026-05-20
URL: CVE-2026-46338
CVSS 3 Score Details (4.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-62q4-447f-wv8h
Release Date: 2026-05-20
Fix Resolution: pymdown-extensions - 10.21.3
Vulnerable Library - pygments-2.19.2-py3-none-any.whl
Pygments is a syntax highlighting package written in Python.
Library home page: https://files.pythonhosted.org/packages/c7/21/705964c7812476f378728bdf590ca4b771ec72385c533964653c68e86bdc/pygments-2.19.2-py3-none-any.whl
Path to dependency file: /docs/Pipfile
Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/docs-1AIbruy1-python/lib/python3.11/site-packages/pygments-2.19.2.dist-info
Dependency Hierarchy:
Found in HEAD commit: 446042fbc4c58f55308d90dae1762e64bf13a474
Found in base branch: develop
Vulnerability Details
A security flaw has been discovered in pygments up to 2.19.2. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular expression complexity. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Publish Date: 2026-03-22
URL: CVE-2026-4539
CVSS 3 Score Details (3.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-5239-wwwm-4pmq
Release Date: 2026-03-22
Fix Resolution: pygments - 2.20.0