https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 21:11:07 +0000 https://vulnerability.circl.lu/vuln/cve-2026-46338 <p><strong>Affected:</strong> facelessuser pymdown-extensions</p> <p>PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containment check in SnippetPreprocessor.get_snippet_path() in pymdownx/snippets.py when `restrict_base_path: True`, allowing markdown snippet directives to read files from sibling paths that share the same base_path prefix, such as docs and docs_internal. This is a regression of CVE-2023-32309. This issue is fixed in version 10.21.3.</p> <p><strong>Affected:</strong> facelessuser pymdown-extensions</p> <p>PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containment check in SnippetPreprocessor.get_snippet_path() in pymdownx/snippets.py when `restrict_base_path: True`, allowing markdown snippet directives to read files from sibling paths that share the same base_path prefix, such as docs and docs_internal. This is a regression of CVE-2023-32309. This issue is fixed in version 10.21.3.</p> https://vulnerability.circl.lu/vuln/cve-2026-46338 https://vulnerability.circl.lu/vuln/ghsa-62q4-447f-wv8h <p><strong>Affected:</strong> PyPI: pymdown-extensions</p> <p># Summary</p> <p>`pymdownx.snippets` has a regression of the CVE-2023-32309 / GHSA-jh85-wwv9-24hv fix. With `restrict_base_path: True` (the default), the current `filename.startswith(base)` containment check does not enforce a directory boundary. As a result, a markdown snippet directive can read files from sibling paths that share the same prefix as `base_path`, such as `docs` vs `docs_internal`.</p> <p>The regression was introduced in PR #2039 / commit `7c13bda5b7793b172efd1abb6712e156a83fe07d`, which replaced the original directory-identity check with a plain string-prefix comparison.</p> <p># Details</p> <p>The regression was introduced in commit `7c13bda5b7793b172efd1abb6712e156a83fe07d` (2023-05-15, #2039 *&#34;Fix regression of snippets nested deeply under specified base path&#34;*), which relaxed the original `os.path.samefile(base, os.path.dirname(filename))` check to a plain `startswith(base)`.</p> <p>`SnippetPreprocessor.get_snippet_path()` in `pymdownx/snippets.py`:</p> <p>```python if self.restrict_base_path: filename = os.path.abspath(os.path.join(base, path)) # If the absolute path is no longer under the specified base path, reject the file if not filename.startswith(base): continue ```</p> <p>`base` is `os.path.abspath(b)` and has no trailing separator. `str.startswith(base)` is `True` for any `filename` whose string representation begins with the same characters as `base`, regardless of whether those characters end at a directory boundary.</p> <p>Concrete example:</p> <p>* `base = &#34;/x/docs&#34;` * `path…</p> <p><strong>Affected:</strong> PyPI: pymdown-extensions</p> <p># Summary</p> <p>`pymdownx.snippets` has a regression of the CVE-2023-32309 / GHSA-jh85-wwv9-24hv fix. With `restrict_base_path: True` (the default), the current `filename.startswith(base)` containment check does not enforce a directory boundary. As a result, a markdown snippet directive can read files from sibling paths that share the same prefix as `base_path`, such as `docs` vs `docs_internal`.</p> <p>The regression was introduced in PR #2039 / commit `7c13bda5b7793b172efd1abb6712e156a83fe07d`, which replaced the original directory-identity check with a plain string-prefix comparison.</p> <p># Details</p> <p>The regression was introduced in commit `7c13bda5b7793b172efd1abb6712e156a83fe07d` (2023-05-15, #2039 *&#34;Fix regression of snippets nested deeply under specified base path&#34;*), which relaxed the original `os.path.samefile(base, os.path.dirname(filename))` check to a plain `startswith(base)`.</p> <p>`SnippetPreprocessor.get_snippet_path()` in `pymdownx/snippets.py`:</p> <p>```python if self.restrict_base_path: filename = os.path.abspath(os.path.join(base, path)) # If the absolute path is no longer under the specified base path, reject the file if not filename.startswith(base): continue ```</p> <p>`base` is `os.path.abspath(b)` and has no trailing separator. `str.startswith(base)` is `True` for any `filename` whose string representation begins with the same characters as `base`, regardless of whether those characters end at a directory boundary.</p> <p>Concrete example:</p> <p>* `base = &#34;/x/docs&#34;` * `path…</p> https://vulnerability.circl.lu/vuln/ghsa-62q4-447f-wv8h https://vulnerability.circl.lu/vuln/pysec-2026-2999 <p><strong>Affected:</strong> PyPI: pymdown-extensions</p> <p># Summary</p> <p>`pymdownx.snippets` has a regression of the CVE-2023-32309 / GHSA-jh85-wwv9-24hv fix. With `restrict_base_path: True` (the default), the current `filename.startswith(base)` containment check does not enforce a directory boundary. As a result, a markdown snippet directive can read files from sibling paths that share the same prefix as `base_path`, such as `docs` vs `docs_internal`.</p> <p>The regression was introduced in PR #2039 / commit `7c13bda5b7793b172efd1abb6712e156a83fe07d`, which replaced the original directory-identity check with a plain string-prefix comparison.</p> <p># Details</p> <p>The regression was introduced in commit `7c13bda5b7793b172efd1abb6712e156a83fe07d` (2023-05-15, #2039 *&#34;Fix regression of snippets nested deeply under specified base path&#34;*), which relaxed the original `os.path.samefile(base, os.path.dirname(filename))` check to a plain `startswith(base)`.</p> <p>`SnippetPreprocessor.get_snippet_path()` in `pymdownx/snippets.py`:</p> <p>```python if self.restrict_base_path: filename = os.path.abspath(os.path.join(base, path)) # If the absolute path is no longer under the specified base path, reject the file if not filename.startswith(base): continue ```</p> <p>`base` is `os.path.abspath(b)` and has no trailing separator. `str.startswith(base)` is `True` for any `filename` whose string representation begins with the same characters as `base`, regardless of whether those characters end at a directory boundary.</p> <p>Concrete example:</p> <p>* `base = &#34;/x/docs&#34;` * `path…</p> <p><strong>Affected:</strong> PyPI: pymdown-extensions</p> <p># Summary</p> <p>`pymdownx.snippets` has a regression of the CVE-2023-32309 / GHSA-jh85-wwv9-24hv fix. With `restrict_base_path: True` (the default), the current `filename.startswith(base)` containment check does not enforce a directory boundary. As a result, a markdown snippet directive can read files from sibling paths that share the same prefix as `base_path`, such as `docs` vs `docs_internal`.</p> <p>The regression was introduced in PR #2039 / commit `7c13bda5b7793b172efd1abb6712e156a83fe07d`, which replaced the original directory-identity check with a plain string-prefix comparison.</p> <p># Details</p> <p>The regression was introduced in commit `7c13bda5b7793b172efd1abb6712e156a83fe07d` (2023-05-15, #2039 *&#34;Fix regression of snippets nested deeply under specified base path&#34;*), which relaxed the original `os.path.samefile(base, os.path.dirname(filename))` check to a plain `startswith(base)`.</p> <p>`SnippetPreprocessor.get_snippet_path()` in `pymdownx/snippets.py`:</p> <p>```python if self.restrict_base_path: filename = os.path.abspath(os.path.join(base, path)) # If the absolute path is no longer under the specified base path, reject the file if not filename.startswith(base): continue ```</p> <p>`base` is `os.path.abspath(b)` and has no trailing separator. `str.startswith(base)` is `True` for any `filename` whose string representation begins with the same characters as `base`, regardless of whether those characters end at a directory boundary.</p> <p>Concrete example:</p> <p>* `base = &#34;/x/docs&#34;` * `path…</p> https://vulnerability.circl.lu/vuln/pysec-2026-2999