pymdown-extensions vulnerabilities
CVEs whose affected-version data names the pymdown-extensions package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
4 CVEsRSS
CVE-2026-61632Medium· 5.3PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path
PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path
▾ Sunlitpymdown-extensions · pymdown-extensionsEPSS 0.42%via OSV
CVE-2026-46338Medium· 4.3Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path
Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path
▾ Sunlitpymdown-extensions · pymdown-extensionsEPSS 0.31%via OSV
CVE-2025-68142LowPyMdown Extensions has a ReDOS bug in its Figure Capture extension
PyMdown Extensions has a ReDOS bug in its Figure Capture extension
▾ Sunlitpymdown-extensions · pymdown-extensionsEPSS 0.48%via OSV
CVE-2023-32309High· 7.5PoCAny file can be included with the pymdown-snippets extension
Any file can be included with the pymdown-snippets extension
▾ Midnightpymdown-extensions · pymdown-extensionsEPSS 1.7%via OSV