Threats tagged 'brew-mcp-atlassian-cve-2026-61632'

The pymdownx.b64 extension for Markdown inlines images as base64 data URIs by reading files from a configured base_path. Due to insufficient path validation, it allows a path traversal attack where an attacker can specify a src path with '../' sequences or absolute paths to read files outside the base_path if they have allowed image extensions. This leads to disclosure of file contents in the rendered output. The vulnerability affects versions from 0.11.9 up to but not including 0.22.0 and has been fixed in version 0.22.0.