Vulnerabilities for pymdown-extensions

First version without a known vulnerability: 11.0.1

Details

• GHSA-gm37-52c6-37mw2026-08-07

  pymdown-extensions: exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processors

  Fixed in: 11.0.1

• GHSA-9xwg-3r6f-jcx22026-07-24

  PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path

  Fixed in: 11.0.0

• GHSA-62q4-447f-wv8h2026-05-19

  Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path

  Fixed in: 10.21.3

• GHSA-r6h4-mm7h-8pmq2025-12-16

  PyMdown Extensions has a ReDOS bug in its Figure Capture extension

  Fixed in: 10.16.1

• GHSA-jh85-wwv9-24hv2023-05-15

  Any file can be included with the pymdown-snippets extension

  Fixed in: 10.0