Is CVE-2026-46338 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-46338?

CVE-2026-46338 has a CVSS v3 severity of MEDIUM (4.3).

Back

CVE-2026-46338

Description

PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containment check in SnippetPreprocessor.get_snippet_path() in pymdownx/snippets.py when `restrict_base_path: True`, allowing markdown snippet directives to read files from sibling paths that share the same base_path prefix, such as docs and docs_internal. This is a regression of CVE-2023-32309. This issue is fixed in version 10.21.3.