Medium [CVE-2026-46338] Information disclosure via crafted Markdown snippets
This medium-severity Red Hat Linux advisory covers CVE-2026-46338 affecting Red Hat Developer Hub, Red Hat OpenShift Container Platform 4, Self-service automation portal 2.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
PyMdown Extensions is a set of extensions for the Python-Markdown markdown project.
From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containment check in SnippetPreprocessor.get_snippet_path() in pymdownx/snippets.py when `restrict_base_path: True`, allowing markdown snippet directives to read files from sibling paths that share the same base_path prefix, such as docs and docs_internal.
This is a regression of CVE-2023-32309. This issue is fixed in version 10.21.3.
A flaw was found in PyMdown Extensions, a tool used for processing Markdown documents. This vulnerability allows an attacker to potentially read sensitive files from unexpected locations on a system.
By crafting a special Markdown snippet, an attacker could trick the system into accessing files outside of the intended directory, leading to unauthorized information disclosure. This issue requires user interaction, meaning a user would need to process a malicious Markdown file for the attack to succeed.
Red Hat ships pymdown-extensions in several products as a bundled dependency. The vulnerability requires an attacker to control Markdown content processed by the pymdownx.snippets extension and for sibling directories with a matching path prefix to exist.
Affected products named by the advisory: Red Hat Developer Hub; Red Hat OpenShift Container Platform 4; Self-service automation portal 2.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 6 days ago·verify at source
Mitigation checklist
- Ensure that untrusted Markdown content is not processed by the pymdownx.snippets extension. If the snippets feature is not required, it can be disabled in the MkDocs or Python-Markdown configuration.
Official advisory · high-confidence parse· fetched 6 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.