mkdocs_material-9.7.3-py3-none-any.whl: 1 vulnerabilities (highest severity is: 4.3)

[mend-bolt-for-github]

Vulnerable Library - mkdocs_material-9.7.3-py3-none-any.whl

Path to dependency file: /docs/build/requirements.txt

Path to vulnerable library: /tmp/ws-ua_20260404120649_GRTYXG/python_INJWTK/202604041207191/env/lib/python3.9/site-packages/pymdown_extensions-10.21.2.dist-info,/tmp/ws-ua_20260421063129_ENTWPD/python_ATEAZC/202604210631591/env/lib/python3.9/site-packages/pymdown_extensions-10.21.2.dist-info

Vulnerabilities

Vulnerability	Severity	CVSS	Dependency	Type	Fixed in (mkdocs_material version)	Remediation Possible**
CVE-2026-46338	Medium	4.3	pymdown_extensions-10.21.2-py3-none-any.whl	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2026-46338

Vulnerable Library - pymdown_extensions-10.21.2-py3-none-any.whl

Extension pack for Python Markdown.

Library home page: https://files.pythonhosted.org/packages/f7/27/a2fc51a4a122dfd1015e921ae9d22fee3d20b0b8080d9a704578bf9deece/pymdown_extensions-10.21.2-py3-none-any.whl

Path to dependency file: /docs/build/requirements.txt

Path to vulnerable library: /tmp/ws-ua_20260404120649_GRTYXG/python_INJWTK/202604041207191/env/lib/python3.9/site-packages/pymdown_extensions-10.21.2.dist-info,/tmp/ws-ua_20260421063129_ENTWPD/python_ATEAZC/202604210631591/env/lib/python3.9/site-packages/pymdown_extensions-10.21.2.dist-info

Dependency Hierarchy:

• mkdocs_material-9.7.3-py3-none-any.whl (Root Library)
  • ❌ pymdown_extensions-10.21.2-py3-none-any.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Summary "pymdownx.snippets" has a regression of the CVE-2023-32309 / GHSA-jh85-wwv9-24hv fix. With "restrict_base_path: True" (the default), the current "filename.startswith(base)" containment check does not enforce a directory boundary. As a result, a markdown snippet directive can read files from sibling paths that share the same prefix as "base_path", such as "docs" vs "docs_internal". The regression was introduced in PR #⁠2039 / commit "7c13bda5b7793b172efd1abb6712e156a83fe07d", which replaced the original directory-identity check with a plain string-prefix comparison. Details The regression was introduced in commit "7c13bda5b7793b172efd1abb6712e156a83fe07d" (2023-05-15, #⁠2039 "Fix regression of snippets nested deeply under specified base path"), which relaxed the original "os.path.samefile(base, os.path.dirname(filename))" check to a plain "startswith(base)". "SnippetPreprocessor.get_snippet_path()" in "pymdownx/snippets.py": if self.restrict_base_path: filename = os.path.abspath(os.path.join(base, path)) # If the absolute path is no longer under the specified base path, reject the file if not filename.startswith(base): continue "base" is "os.path.abspath(b)" and has no trailing separator. "str.startswith(base)" is "True" for any "filename" whose string representation begins with the same characters as "base", regardless of whether those characters end at a directory boundary. Concrete example: * "base = "/x/docs"" * "path = "../docs_secret/leak.txt"" (inside the markdown snippet directive) * "os.path.join(base, path)" → ""/x/docs/../docs_secret/leak.txt"" * "os.path.abspath(...)" → ""/x/docs_secret/leak.txt"" * "filename.startswith(base)" → "True", because ""/x/docs_secret/..."" begins with the literal string ""/x/docs"". All releases from 10.0.1 (2023-05-15) through 10.21.2 (current) are affected. Impact Arbitrary file read within the host the build runs on, bounded by the prefix match. With "base_path = /x/docs" the attacker can read files from any sibling directory whose path begins with the literal string "/x/docs" followed by any non-separator character — for example "/x/docs_internal/", "/x/docs.bak/", "/x/docs2/". The threat model is the same as the original CVE-2023-32309: markdown content processed by the snippets preprocessor in a build pipeline (typical scenario: an MkDocs documentation site built in CI from PR contributions or otherwise less-trusted markdown) can read files outside the configured base. CI builds that publish the generated HTML expose the read file to the public; CI builds with secrets on disk leak those secrets. Reproduction Minimal local PoC, non-destructive: import os, shutil, tempfile, markdown work = tempfile.mkdtemp(prefix="pmx_poc_") try: base = os.path.join(work, "docs") sibling = os.path.join(work, "docs_secret") os.makedirs(base) os.makedirs(sibling) with open(os.path.join(sibling, "leak.txt"), "w") as f: f.write("TOP_SECRET_FROM_SIBLING_DIR\n") out = markdown.markdown( '--8<-- "../docs_secret/leak.txt"\n', extensions=["pymdownx.snippets"], extension_configs={ "pymdownx.snippets": { "base_path": [base], "restrict_base_path": True, "check_paths": True, } }, ) print(out) # ->

TOP_SECRET_FROM_SIBLING_DIR

finally: shutil.rmtree(work) Default "restrict_base_path: True" is sufficient — no non-default option is required. Suggested fix Minimal change — require the separator after the base prefix: - if not filename.startswith(base): + # Append os.sep so a sibling directory whose name shares a prefix + # (e.g. /x/docs vs /x/docs_evil) cannot satisfy the check. + if not filename.startswith(base + os.sep): continue This preserves the original intent (allow snippets nested at any depth under "base_path") while restoring the directory-boundary check. It does not affect the "os.path.isdir(base)" branch where "base" is a file (that branch still uses "os.path.samefile"). Alternative: "os.path.commonpath([base, filename]) == base" is equivalent and slightly more idiomatic, though it raises "ValueError" on different drives on Windows and would need a "try/except". The "startswith(base + os.sep)" fix is the smaller diff. Note: this fix does not change behaviour for symlinks inside "base_path". The existing implementation uses "os.path.abspath" (not "os.path.realpath"), so a symlink within "base_path" pointing outside is still followed. That is a separate concern — symlinks require write access to "base_path", a much higher bar than the current bypass — and matches the behaviour the CVE-2023 fix established. Regression test A regression test class "TestSnippetsSiblingPrefix" was added in "tests/test_extensions/test_snippets.py". It uses "tests/test_extensions/_snippets/nested" as "base_path" and a new fixture directory "tests/test_extensions/_snippets/nested_sibling_evil/leak.txt". It asserts that the markdown directive "--8<-- "../nested_sibling_evil/leak.txt"" raises "SnippetMissingError". * Without fix: test fails ("AssertionError: SnippetMissingError not raised", sibling file is silently read). * With fix: test passes. Full suite: "python -m pytest tests/ -q" → 738 passed (737 baseline + 1 new regression test). No regressions. Affected versions ">= 10.0.1, <= 10.21.2"

Publish Date: 2026-06-05

URL: CVE-2026-46338

CVSS 3 Score Details (4.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-05-20

Fix Resolution: https://github.com/facelessuser/pymdown-extensions.git - 10.21.3,pymdown-extensions - 10.21.3

Step up your Open Source Security Game with Mend here