CVE-2026-46338: Facelessuser Pymdown Extensions

Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days.

PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containment check in SnippetPreprocessor.get_snippet_path() in pymdownx/snippets.py when `restrict_base_path: True`, allowing markdown snippet directives to read files from sibling paths that share the same base_path prefix, such as docs and docs_internal. This is a regression of CVE-2023-32309. This issue is fixed in version 10.21.3.

Affected products

• Facelessuser Pymdown Extensions: from 10.0.1, before 10.21.3 (fixed in 10.21.3)

Published 2026-07-16. Last modified 2026-07-30.