CVE-2026-61632

Name of the Vulnerable Software and Affected Versions pymdown-extensions version 10.21.3

Description The b64 extension inlines images referenced by <img src="..."> as base64 data URIs. The repl path() function in pymdownx/b64.py fails to verify that the resolved path remains within the configured base path. An attacker can use absolute paths or ../ sequences in the src attribute to read files outside the intended directory, provided the files have an allowed image extension such as .png, .jpg, .jpeg, .gif, or .svg. The contents of these files are then embedded as base64 strings in the rendered output, leading to unauthorized information disclosure.

Recommendations For version 10.21.3, resolve the real path of the file and ensure it starts with the real path of the base path before opening the file. As a temporary mitigation, restrict the use of the pymdownx.b64 extension when rendering untrusted Markdown.