# pymdown-extensions (PyPI) vulnerabilities 5 known vulnerabilities (2 high, 2 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 12.3.0 (Oct 14, 2026): no advisory affects it - Newest unaffected release: 12.3.0 (Oct 14, 2026), the latest release - Weekly downloads: 5.7M - Dependents: 1,193 - Releases: 126 since 1.0.0 (Dec 8, 2015) - Registry: https://pypi.org/project/pymdown-extensions/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-61632: 1.0.0 to 10.21.3 (11.0.0 is outside it) - CVE-2026-67422: 1.0.0 to 11.0.0 (11.0.1 is outside it) - CVE-2026-46338: 10.0.1 to 10.21.2 (10.21.3 is outside it) - CVE-2025-68142: 1.0.0 to 10.16.0 (10.16.1 is outside it) - CVE-2023-32309: 1.5.0 to 9.11.0 (10.0.0 is outside it) ## Advisories (5) ### [CVE-2026-61632](https://cve.now/CVE-2026-61632): PyMdown Extensions: Path traversal in the b64 extension lets \ read files outside base\_path - Severity: Medium 5.3 - Published: Aug 6, 2026 - Affected: fixed in 11.0.0. - Fixed in 11.0.0 (released Jun 23, 2026, 44 days before disclosure). - The latest release, 12.3.0, is not affected. ### [CVE-2026-67422](https://cve.now/CVE-2026-67422): pymdown-extensions: Exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processors - Severity: High 7.5 - Published: Aug 6, 2026 - Affected: fixed in 11.0.1. - Fixed in 11.0.1 (released Jul 2, 2026, 35 days before disclosure). - The latest release, 12.3.0, is not affected. ### [CVE-2026-46338](https://cve.now/CVE-2026-46338): PyMdown Extensions: Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict\_base\_path - Severity: Medium 4.3 - Published: Jul 16, 2026 - Affected: from 10.0.1, fixed in 10.21.3. - Fixed in 10.21.3 (released May 13, 2026, 64 days before disclosure). - The latest release, 12.3.0, is not affected. ### [CVE-2025-68142](https://cve.now/CVE-2025-68142): PyMdown Extensions has ReDOS bug in Figure Capture extension - Severity: Low 2.7 - Published: Dec 16, 2025 - Affected: fixed in 10.16.1. - Fixed in 10.16.1 (released Jul 28, 2025, 141 days before disclosure). - The latest release, 12.3.0, is not affected. ### [CVE-2023-32309](https://cve.now/CVE-2023-32309): Arbitrary file inclusion with the pymdowm-snippets extension - Severity: High 7.5 - Published: May 15, 2023 - Affected: from 1.5, fixed in 10.0. - Fixed in 10.0.0 (released May 15, 2023, the day of disclosure). - The latest release, 12.3.0, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/pymdown-extensions Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.