Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

pymdown-extensions

5 known vulnerabilities (2 high, 2 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
12.3.0 (Oct 14, 2026): no advisory affects it
Newest unaffected release
12.3.0 (Oct 14, 2026), the latest release
Advisories
5 · 2 high, 2 medium, 1 low
Weekly downloads
5.7M
Dependents
1,193
Releases
126 since 1.0.0 (Dec 8, 2015)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 5

  • CVE-2026-61632Medium 5.3

    PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path

    Affected: fixed in 11.0.0.

    Fixed in 11.0.0 (released Jun 23, 2026, 44 days before disclosure).

    The latest release, 12.3.0, is not affected.

  • pymdown-extensions: Exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processors

    Affected: fixed in 11.0.1.

    Fixed in 11.0.1 (released Jul 2, 2026, 35 days before disclosure).

    The latest release, 12.3.0, is not affected.

  • CVE-2026-46338Medium 4.3

    PyMdown Extensions: Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path

    Affected: from 10.0.1, fixed in 10.21.3.

    Fixed in 10.21.3 (released May 13, 2026, 64 days before disclosure).

    The latest release, 12.3.0, is not affected.

  • PyMdown Extensions has ReDOS bug in Figure Capture extension

    Affected: fixed in 10.16.1.

    Fixed in 10.16.1 (released Jul 28, 2025, 141 days before disclosure).

    The latest release, 12.3.0, is not affected.

  • Arbitrary file inclusion with the pymdowm-snippets extension

    Affected: from 1.5, fixed in 10.0.

    Fixed in 10.0.0 (released May 15, 2023, the day of disclosure).

    The latest release, 12.3.0, is not affected.