Update dependency pymdown-extensions to v11 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
pymdown-extensions	==10.16.1 → ==11.0

---

Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path

CVE-2026-46338 / GHSA-62q4-447f-wv8h

More information

Details

Summary

pymdownx.snippets has a regression of the CVE-2023-32309 / GHSA-jh85-wwv9-24hv fix. With restrict_base_path: True (the default), the current filename.startswith(base) containment check does not enforce a directory boundary. As a result, a markdown snippet directive can read files from sibling paths that share the same prefix as base_path, such as docs vs docs_internal.

The regression was introduced in PR #​2039 / commit 7c13bda5b7793b172efd1abb6712e156a83fe07d, which replaced the original directory-identity check with a plain string-prefix comparison.

Details

The regression was introduced in commit 7c13bda5b7793b172efd1abb6712e156a83fe07d (2023-05-15, #​2039 "Fix regression of snippets nested deeply under specified base path"), which relaxed the original os.path.samefile(base, os.path.dirname(filename)) check to a plain startswith(base).

SnippetPreprocessor.get_snippet_path() in pymdownx/snippets.py:

if self.restrict_base_path:
    filename = os.path.abspath(os.path.join(base, path))
    # If the absolute path is no longer under the specified base path, reject the file
    if not filename.startswith(base):
        continue

base is os.path.abspath(b) and has no trailing separator. str.startswith(base) is True for any filename whose string representation begins with the same characters as base, regardless of whether those characters end at a directory boundary.

Concrete example:

• base = "/x/docs"
• path = "../docs_secret/leak.txt" (inside the markdown snippet directive)
• os.path.join(base, path) → "/x/docs/../docs_secret/leak.txt"
• os.path.abspath(...) → "/x/docs_secret/leak.txt"
• filename.startswith(base) → True, because "/x/docs_secret/..." begins with the literal string "/x/docs".

All releases from 10.0.1 (2023-05-15) through 10.21.2 (current) are affected.

Impact

Arbitrary file read within the host the build runs on, bounded by the prefix match. With base_path = /x/docs the attacker can read files from any sibling directory whose path begins with the literal string /x/docs followed by any non-separator character — for example /x/docs_internal/, /x/docs.bak/, /x/docs2/.

The threat model is the same as the original CVE-2023-32309: markdown content processed by the snippets preprocessor in a build pipeline (typical scenario: an MkDocs documentation site built in CI from PR contributions or otherwise less-trusted markdown) can read files outside the configured base. CI builds that publish the generated HTML expose the read file to the public; CI builds with secrets on disk leak those secrets.

Reproduction

Minimal local PoC, non-destructive:

import os, shutil, tempfile, markdown

work = tempfile.mkdtemp(prefix="pmx_poc_")
try:
    base    = os.path.join(work, "docs")
    sibling = os.path.join(work, "docs_secret")
    os.makedirs(base)
    os.makedirs(sibling)
    with open(os.path.join(sibling, "leak.txt"), "w") as f:
        f.write("TOP_SECRET_FROM_SIBLING_DIR\n")

    out = markdown.markdown(
        '--8<-- "../docs_secret/leak.txt"\n',
        extensions=["pymdownx.snippets"],
        extension_configs={
            "pymdownx.snippets": {
                "base_path": [base],
                "restrict_base_path": True,
                "check_paths": True,
            }
        },
    )
    print(out)  # -> <p>TOP_SECRET_FROM_SIBLING_DIR</p>
finally:
    shutil.rmtree(work)

Default restrict_base_path: True is sufficient — no non-default option is required.

Suggested fix

Minimal change — require the separator after the base prefix:

-                        if not filename.startswith(base):
+                        # Append `os.sep` so a sibling directory whose name shares a prefix
+                        # (e.g. `/x/docs` vs `/x/docs_evil`) cannot satisfy the check.
+                        if not filename.startswith(base + os.sep):
                             continue

This preserves the original intent (allow snippets nested at any depth under base_path) while restoring the directory-boundary check. It does not affect the os.path.isdir(base) branch where base is a file (that branch still uses os.path.samefile).

Alternative: os.path.commonpath([base, filename]) == base is equivalent and slightly more idiomatic, though it raises ValueError on different drives on Windows and would need a try/except. The startswith(base + os.sep) fix is the smaller diff.

Note: this fix does not change behaviour for symlinks inside base_path. The existing implementation uses os.path.abspath (not os.path.realpath), so a symlink within base_path pointing outside is still followed. That is a separate concern — symlinks require write access to base_path, a much higher bar than the current bypass — and matches the behaviour the CVE-2023 fix established.

Regression test

A regression test class TestSnippetsSiblingPrefix was added in tests/test_extensions/test_snippets.py. It uses tests/test_extensions/_snippets/nested as base_path and a new fixture directory tests/test_extensions/_snippets/nested_sibling_evil/leak.txt. It asserts that the markdown directive --8<-- "../nested_sibling_evil/leak.txt" raises SnippetMissingError.

• Without fix: test fails (AssertionError: SnippetMissingError not raised, sibling file is silently read).
• With fix: test passes.

Full suite: python -m pytest tests/ -q → 738 passed (737 baseline + 1 new regression test). No regressions.

Affected versions

>= 10.0.1, <= 10.21.2

Severity

• CVSS Score: 4.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

References

• https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-62q4-447f-wv8h
• https://github.com/facelessuser/pymdown-extensions/pull/2039
• https://github.com/advisories/GHSA-62q4-447f-wv8h

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

PyMdown Extensions: Path traversal in the b64 extension lets read files outside base_path

CVE-2026-61632 / GHSA-9xwg-3r6f-jcx2

More information

Details

Summary

The b64 extension inlines images referenced by <img src="..."> as base64 data URIs. When resolving the src path it joins it onto the configured base_path with os.path.normpath and opens the result directly, with no check that the resolved path stays inside base_path. A src containing ../ sequences, or an absolute path, therefore reads a file outside base_path as long as that file has an allowed image extension (.png, .jpg, .jpeg, .gif, .svg). The base64 of that file is then embedded in the rendered output, disclosing its contents.

This is a separate code path from the snippets traversal issues (GHSA-jh85-wwv9-24hv, GHSA-62q4-447f-wv8h). It lives in pymdownx/b64.py and has no path restriction of any kind. Confirmed on 10.21.3 installed from PyPI.

Details

In pymdownx/b64.py, function repl_path (around lines 68 to 90 on main):

if is_absolute:
    file_name = os.path.normpath(path)                          # absolute src: base_path ignored entirely
else:
    file_name = os.path.normpath(os.path.join(base_path, path)) # relative src: '../' escapes base_path
if os.path.exists(file_name):
    ext = os.path.splitext(file_name)[1].lower()
    for b64_ext in file_types:
        if ext in b64_ext:
            with open(file_name, "rb") as f:                    # opened with no containment check
                ...

There is no startswith(base_path), no os.path.realpath comparison, and no rejection of ... Both branches are reachable from an attacker-controlled src.

PoC

Reproduced against an unmodified pymdown-extensions==10.21.3 from PyPI. The script creates a base_path directory and a PNG one level above it, then renders Markdown whose image src points outside base_path, and confirms the outside file's bytes appear base64-encoded in the output.

import base64, os, shutil, tempfile, markdown

root = tempfile.mkdtemp()
base_path = os.path.join(root, "docs"); os.makedirs(base_path)
outside = os.path.join(root, "secret"); os.makedirs(outside)

png = base64.b64decode(
    "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNk"
    "+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg=="
)
with open(os.path.join(outside, "secret.png"), "wb") as f:
    f.write(png)

md = markdown.Markdown(
    extensions=["pymdownx.b64"],
    extension_configs={"pymdownx.b64": {"base_path": base_path}},
)
html = md.convert('<img src="../secret/secret.png">')

assert base64.b64encode(png).decode() in html, "not leaked"
print("LEAKED:", html)

Output:

LEAKED: <p><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQ..."></p>

The base64 of a file outside base_path is present in the output. The absolute-path branch behaves the same way: an absolute src bypasses base_path entirely via os.path.normpath(path). Both were confirmed leaking.

Impact

An application that renders untrusted Markdown with pymdownx.b64 enabled exposes the contents of image-extension files on the server, or any path the process can read, to whoever controls the Markdown and whoever views the output. The reach is bounded by the image-extension check, so it is a targeted file read rather than full arbitrary read, but it still discloses file contents that were never meant to be exposed.

Suggested fix

Resolve the real path and require it to stay within base_path before opening:

file_name = os.path.realpath(os.path.join(base_path, path))
base_real = os.path.realpath(base_path)
if file_name != base_real and not file_name.startswith(base_real + os.sep):
    return m.group(0)  # leave the tag untouched; do not read outside base_path

The same containment check should apply to the absolute-path branch rather than trusting an absolute src. Using realpath instead of abspath also closes the related symlink-following gap in the snippets handler.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

• https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-9xwg-3r6f-jcx2
• https://github.com/facelessuser/pymdown-extensions/commit/edce35586d11a1ef78bb187bc60497fe6dbf3b64
• https://github.com/facelessuser/pymdown-extensions/releases/tag/11.0
• https://github.com/advisories/GHSA-9xwg-3r6f-jcx2

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

facelessuser/pymdown-extensions (pymdown-extensions)

v11.0

Compare Source

11.0

• BREAK: B64: Restricts relative links to base_path by default. Can be disabled by setting new restrict_path
  option to False. The new root_path can be specified if paths are desired to be restricted to a different
  location separate base_path which is also used as a relative base for image paths.
• NEW: Drop Python 3.9 support.
• FIX: Tabbed: Fix issue where an empty title would cause an exception.

v10.21.3

Compare Source

10.21.3

• FIX: Fix regression that allows a snippet to be loaded outside of the base path using directory traversal when
  restrict_base_path is enabled (the default). Found by @​gistrec.

v10.21.2: 10.21. 2

Compare Source

10.21.2

• FIX: Highlight: Latest Pygments versions cannot handle a "filename" for code block titles of None.

v10.21

10.21

• NEW: Caption: Add support for specifying not only IDs but classes and arbitrary attributes. Initial work by
  @​joapuiib.
• FIX: MagicLink: Fix a matching pattern for Bitbucket repo.

v10.20

Compare Source

10.20

• NEW: Quotes: New blockquotes extension added that uses a more modern approach when compared to Python Markdown's
  default. Quotes specifically will not group consecutive blockquotes together in the same lazy fashion that the
  default Python Markdown does which follows a more modern trend to how parsers these days handle block quotes.

  In addition, Quotes also provides an optional feature to enable specifying callouts/alerts in the style used by
  GitHub and Obsidian.

v10.19.1

Compare Source

10.19.1

• FIX: Arithmatex: Fix issue where block $$ math used inline within a paragraph could result in nested math
  parsing.

v10.19

Compare Source

10.19

• NEW: Emoji: Update Twemoji to use Unicode 16.
• NEW: Critic: Roll back view mode deprecation as some still like to use it, though further enhancements to this
  mode are not planned.

v10.18

Compare Source

10.18

• NEW: Critic: view mode has been deprecated. To avoid warnings or future issues, explicitly set mode to
  either accept or reject. In the future, the new default will be accept and the view mode will be removed
  entirely.
• FIX: Block Admonition: important should have always been available as a default.

v10.17.2

Compare Source

10.17.2

• FIX: Blocks: Blocks extensions will now better handle nesting of indented style Admonitions, Details, and Tabbed
  and other non-conflicting blocks.

v10.17.1

Compare Source

10.17.1

• FIX: Fix an issue where Highlight can override another extension in the "registered" list in Python Markdown.

v10.17

Compare Source

10.17

• NEW: Allow specifying static IDs in caption block headers via #id syntax.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.