CVE-2026-46338

PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containment check in SnippetPreprocessor.get_snippet_path() in pymdownx/snippets.py when `restrict_base_path: True`, allowing markdown snippet directives to read files from sibling paths that share the same base_path prefix, such as docs and docs_internal. This is a regression of CVE-2023-32309. This issue is fixed in version 10.21.3.

• CWE-22

• https://github.com/facelessuser/pymdown-extensions/commit/63b7835776d703d6c339cf2110d9888f676efc0cPatch
• https://github.com/facelessuser/pymdown-extensions/releases/tag/10.21.3Product, Release Notes
• https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-62q4-447f-wv8hExploit, Mitigation, Vendor Advisory
• https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-62q4-447f-wv8hExploit, Mitigation, Vendor Advisory

Published

Jul 16, 2026

Last Modified

Jul 30, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-46331In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-46332In the Linux kernel, the following vulnerability has been re…8
• CVE-2026-46333In the Linux kernel, the following vulnerability has been re…7.1
• CVE-2026-46334OpenSIPS is a Session Initiation Protocol (SIP) server imple…8.7
• CVE-2026-46336Manyfold is an open source, self-hosted web application for …7.1
• CVE-2026-46337WWBN AVideo is an open source video platform. In 29.0 and ea…5.3
• CVE-2026-463399Router is an AI router & token saver. From 0.4.30 until 0.4…10
• CVE-2026-4634A flaw was found in Keycloak. An unauthenticated attacker ca…7.5
• CVE-2026-46340Netty is a network application framework for development of …7.5
• CVE-2026-46341The Apify MCP server enables AI agents to extract data from …6.1
• CVE-2026-46342Nuxt is an open-source web development framework for Vue.js.…5.4
• CVE-2026-46344liboqs is a C-language cryptographic library that provides i…5.3