Security: facelessuser/pymdown-extensions
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
pymdown-extensions: exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processorsGHSA-gm37-52c6-37mw published
Jul 29, 2026 by facelessuserHigh -
Path traversal in the b64 extension lets <img src> read files outside base_pathGHSA-9xwg-3r6f-jcx2 published
Jul 10, 2026 by facelessuserModerate -
Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_pathGHSA-62q4-447f-wv8h published
May 13, 2026 by facelessuserModerate -
ReDOS bug in Figure Capture extensionGHSA-r6h4-mm7h-8pmq published
Dec 15, 2025 by facelessuserModerate -
Any file can be included with the pymdowm-snippets extensionGHSA-jh85-wwv9-24hv published
May 15, 2023 by facelessuserCritical