Server-side Request Forgery (SSRF)

Overview @backstage/plugin-techdocs-node is a Common node.js functionalities for TechDocs, to be shared between techdocs-backend plugin and techdocs-cli Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the sanitizeMkdocsYml function in mkdocsPatchers.ts,...

OESA-2026-4182 python-pymdown-extensions security update

Extension pack for Python Markdown. Security Fixes: PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containment check in SnippetPreprocessor.getsnippetpath in pymdownx/snippets.py when...

CVE-2026-46338

PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containment check in SnippetPreprocessor.getsnippetpath in pymdownx/snippets.py when "restrictbasepath: True", allowing markdown snippet directives...

CVE-2026-46338: Improper Limitation of a Pathname to a Restricted Directory

PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containment check in SnippetPreprocessor.getsnippetpath in pymdownx/snippets.py when restrictbasepath: True, allowing markdown snippet directives t...