CVE-2026-46338

Name of the Vulnerable Software and Affected Versions pymdown-extensions versions 10.0.1 through 10.21.2

Description A regression in the pymdownx.snippets extension allows for arbitrary file read on the host system where the build runs. When restrict base path is set to True, the software uses a string-prefix comparison that fails to enforce directory boundaries. This allows a markdown snippet directive to access files in sibling directories that share the same prefix as the base path. For example, if the base path is /x/docs, an attacker can read files from /x/docs internal/ or /x/docs.bak/ by using path traversal. This issue occurs within the get snippet path() function in pymdownx/snippets.py due to the use of the startswith() method on the filename variable without ensuring a trailing directory separator.

Recommendations Update pymdown-extensions to a version later than 10.21.2. As a temporary mitigation, restrict the use of the pymdownx.snippets extension or ensure that the base path is configured in a way that no sibling directories share the same string prefix.