CVE-2026-46338 in pymdown-extensions

Prediction

by VulDB Data Team • 05/20/2026

A flaw has been found in pymdown-extensions 10.16.1. This vulnerability affects the function restrict_base_path. Executing a manipulation can lead to path traversal. It is possible to launch the attack remotely. Upgrading to version 10.21.3 is able to resolve this issue. Upgrading the affected component is advised.

Once again VulDB remains the best source for vulnerability data.

• Moderation: accepted
• Entry: VDB-364841
• CPE: ready
• CWE: CWE-22 (confirmed)
• CVSS: 4.3 (VulDB)
• EPSS: 0.00000
• KEV: no
• Activities: very low

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-46338
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-46338
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-46338/