fix(deps): raise pymdown-extensions past two path-traversal/ReDoS advisories - #619
Merged
Merged
Conversation
OpenSSF Scorecard's Vulnerabilities check reports these against the repository while Dependabot reports nothing, because the floors here are open ranges rather than a lockfile it tracks. The advisories are real and the fix is a floor bump. mkdocs-material below 9.7.7 carries GHSA-xvg9-69gf-fjrf, a DOM XSS in search suggestions reachable through a query parameter. That one lands on the published docs site, not just the build. pymdown-extensions below 11.0.2 carries a path traversal in the b64 extension that lets an <img src> read outside base_path (PYSEC-2026-3609), a sibling-prefix traversal regression that defeats restrict_base_path (PYSEC-2026-2999), and exponential-backtracking ReDoS in several inline processors (PYSEC-2026-3654, PYSEC-2026-1825). Docs tooling rather than runtime, so this does not touch the shipped package. Sibling repos are already on these floors; these were the two left behind. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XbDBXDWWvMFa7c2jGgyq9t
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the two advisories OpenSSF Scorecard reports against this repo. Dependabot reports nothing here because this is an open version range in
requirements-docs.txtrather than a lockfile it tracks.<img src>can read files outsidebase_pathThe floor was
>=10.21.3, which covers the earlier sibling-prefix traversal regression but sits below both of these. Raised to>=11.0.2, the current release and the floorca2aandtrace-testsalready use.Docs tooling only. Nothing here reaches
cmcp-runtime.🤖 Generated with Claude Code
https://claude.ai/code/session_01XbDBXDWWvMFa7c2jGgyq9t