PyMdown Extensions vulnerabilities

pymdown-extensions up to version 11.0 contains a vulnerability to catastrophic backtracking in four inline processors (caret, tilde, betterem, magiclink). A single untrusted Markdown line under 50 bytes can cause unbounded CPU usage, enabling a remote attacker to cause denial of service. The issue is fixed in version 11.0.1.

PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. In versions up to and including 10.21.3, the b64 extension is vulnerable to a path traversal that discloses arbitrary files: it inlines images referenced by <img src="..."> by joining the src onto the configured base_path with os.path.normpath and opening the result directly, without verifying that the resolved path stays inside base_path. As a result, an src containing ../ sequences or an absolute path reads a file outside base_path as long as it has an allowed image extension (.png, .jpg, .jpeg, .gif, .svg), and the file's contents are then base64-encoded into the rendered output, disclosing them. This issue has been fixed in version 11.0.

A vulnerability in PyMdown Extensions (versions 10.0.1 through 10.21.3) allows bypassing the base path restriction in the SnippetPreprocessor.get_snippet_path() function. The string-prefix containment check enables reading files from sibling directories sharing the same base_path prefix, representing a regression of the fix for CVE-2023-32309.