mkdocs_material-9.7.6-py3-none-any.whl: 8 vulnerabilities (highest severity is: 8.6) - autoclosed

[mend-for-github-com]

Vulnerable Library - mkdocs_material-9.7.6-py3-none-any.whl

Documentation that simply works

Library home page: https://files.pythonhosted.org/packages/2c/01/bc663630c510822c95c47a66af9fa7a443c295b47d5f041e5e6ae62ef659/mkdocs_material-9.7.6-py3-none-any.whl

Sample Path to Dependency File: /docs/Pipfile

Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/docs-1AIbruy1-python/lib/python3.11/site-packages/mkdocs_material-9.7.6.dist-info

Found in HEAD commit: 446042fbc4c58f55308d90dae1762e64bf13a474

Vulnerabilities

Vulnerability	Severity	CVSS	Dependency	Type	Fixed in (mkdocs_material version)	Remediation Possible**
CVE-2026-44432	High	8.6	urllib3-2.6.3-py3-none-any.whl	Transitive	9.7.7	✅
CVE-2026-67422	High	7.5	pymdown_extensions-10.21-py3-none-any.whl	Transitive	9.7.7	✅
CVE-2026-44431	Medium	5.9	urllib3-2.6.3-py3-none-any.whl	Transitive	9.7.7	✅
CVE-2026-73295	Medium	5.4	mkdocs_material-9.7.6-py3-none-any.whl	Direct	9.7.7	✅
CVE-2026-61632	Medium	5.3	pymdown_extensions-10.21-py3-none-any.whl	Transitive	9.7.7	✅
CVE-2026-45409	Medium	5.3	idna-3.11-py3-none-any.whl	Transitive	N/A*	❌
CVE-2026-46338	Medium	4.3	pymdown_extensions-10.21-py3-none-any.whl	Transitive	N/A*	❌
CVE-2026-4539	Low	3.3	pygments-2.19.2-py3-none-any.whl	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2026-44432

Vulnerable Library - urllib3-2.6.3-py3-none-any.whl

HTTP library with thread-safe connection pooling, file post, and more.

Library home page: https://files.pythonhosted.org/packages/39/08/aaaad47bc4e9dc8c725e68f9d04865dbcb2052843ff09c97b08904852d84/urllib3-2.6.3-py3-none-any.whl

Sample Path to Dependency File: /docs/Pipfile

Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/docs-1AIbruy1-python/lib/python3.11/site-packages/urllib3-2.6.3.dist-info

Dependency Hierarchy:

• mkdocs_material-9.7.6-py3-none-any.whl (Root Library)
  • requests-2.33.0-py3-none-any.whl
    • ❌ urllib3-2.6.3-py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 446042fbc4c58f55308d90dae1762e64bf13a474

Found in base branch: develop

Vulnerability Details

urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Brotli library or (2) when HTTPResponse.drain_conn() was called after the response had been read and decompressed partially (compression algorithm did not matter here). These issues could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This could result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data) on the client side. This vulnerability is fixed in 2.7.0.

Publish Date: 2026-05-13

URL: CVE-2026-44432

CVSS 3 Score Details (8.6)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-mf9v-mfxr-j63j

Release Date: 2026-05-11

Fix Resolution (urllib3): 2.7.0

Direct dependency fix Resolution (mkdocs-material): 9.7.7

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2026-67422

Vulnerable Library - pymdown_extensions-10.21-py3-none-any.whl

Extension pack for Python Markdown.

Library home page: https://files.pythonhosted.org/packages/6f/2c/5b079febdc65e1c3fb2729bf958d18b45be7113828528e8a0b5850dd819a/pymdown_extensions-10.21-py3-none-any.whl

Sample Path to Dependency File: /docs/Pipfile

Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/docs-1AIbruy1-python/lib/python3.11/site-packages/pymdown_extensions-10.21.dist-info

Dependency Hierarchy:

• mkdocs_material-9.7.6-py3-none-any.whl (Root Library)
  • ❌ pymdown_extensions-10.21-py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 446042fbc4c58f55308d90dae1762e64bf13a474

Found in base branch: develop

Vulnerability Details

pymdown-extensions is a collection of extensions for the Python Markdown library. In versions up to and including 11.0, four inline processors (caret, tilde, betterem, and magiclink) use regular expressions whose content groups can partition a run of delimiter characters in exponentially many ways, causing catastrophic backtracking. As a result, a single untrusted Markdown line under 50 bytes rendered with markdown.markdown() in each extension's default configuration drives the rendering thread into unbounded CPU usage that grows exponentially with input length, enabling an unauthenticated remote attacker who can submit Markdown to cause denial of service. The exposure is concrete for web applications that render user-supplied Markdown (comments, wikis, issue bodies, live preview), including any app using pymdownx.extra which bundles the vulnerable betterem default, as well as hosted docs/CI systems that build untrusted Markdown. The issue has been fixed in version 11.0.1.

Publish Date: 2026-08-06

URL: CVE-2026-67422

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-gm37-52c6-37mw

Release Date: 2026-08-06

Fix Resolution (pymdown-extensions): 11.0.1

Direct dependency fix Resolution (mkdocs-material): 9.7.7

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2026-44431

Vulnerable Library - urllib3-2.6.3-py3-none-any.whl

HTTP library with thread-safe connection pooling, file post, and more.

Library home page: https://files.pythonhosted.org/packages/39/08/aaaad47bc4e9dc8c725e68f9d04865dbcb2052843ff09c97b08904852d84/urllib3-2.6.3-py3-none-any.whl

Sample Path to Dependency File: /docs/Pipfile

Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/docs-1AIbruy1-python/lib/python3.11/site-packages/urllib3-2.6.3.dist-info

Dependency Hierarchy:

• mkdocs_material-9.7.6-py3-none-any.whl (Root Library)
  • requests-2.33.0-py3-none-any.whl
    • ❌ urllib3-2.6.3-py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 446042fbc4c58f55308d90dae1762e64bf13a474

Found in base branch: develop

Vulnerability Details

urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.

Publish Date: 2026-05-13

URL: CVE-2026-44431

CVSS 3 Score Details (5.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-qccp-gfcp-xxvc

Release Date: 2026-05-11

Fix Resolution (urllib3): 2.7.0

Direct dependency fix Resolution (mkdocs-material): 9.7.7

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2026-73295

Vulnerable Library - mkdocs_material-9.7.6-py3-none-any.whl

Documentation that simply works

Library home page: https://files.pythonhosted.org/packages/2c/01/bc663630c510822c95c47a66af9fa7a443c295b47d5f041e5e6ae62ef659/mkdocs_material-9.7.6-py3-none-any.whl

Sample Path to Dependency File: /docs/Pipfile

Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/docs-1AIbruy1-python/lib/python3.11/site-packages/mkdocs_material-9.7.6.dist-info

Dependency Hierarchy:

• ❌ mkdocs_material-9.7.6-py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 446042fbc4c58f55308d90dae1762e64bf13a474

Found in base branch: develop

Vulnerability Details

Material for MkDocs is a powerful documentation framework built on top of MkDocs. From 7.2.0 until 9.7.7, the mountSearchSuggest function in src/templates/assets/javascripts/components/search/suggest/index.ts contains a DOM-based cross-site scripting vulnerability in the optional search.suggest feature that allows a crafted q URL parameter to execute JavaScript in a documentation site's origin after user interaction. This issue is fixed in version 9.7.7.

Publish Date: 2026-08-12

URL: CVE-2026-73295

CVSS 3 Score Details (5.4)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-xvg9-69gf-fjrf

Release Date: 2026-08-12

Fix Resolution: 9.7.7

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2026-61632

Vulnerable Library - pymdown_extensions-10.21-py3-none-any.whl

Extension pack for Python Markdown.

Library home page: https://files.pythonhosted.org/packages/6f/2c/5b079febdc65e1c3fb2729bf958d18b45be7113828528e8a0b5850dd819a/pymdown_extensions-10.21-py3-none-any.whl

Sample Path to Dependency File: /docs/Pipfile

Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/docs-1AIbruy1-python/lib/python3.11/site-packages/pymdown_extensions-10.21.dist-info

Dependency Hierarchy:

• mkdocs_material-9.7.6-py3-none-any.whl (Root Library)
  • ❌ pymdown_extensions-10.21-py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 446042fbc4c58f55308d90dae1762e64bf13a474

Found in base branch: develop

Vulnerability Details

PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. In versions up to and including 10.21.3, the b64 extension is vulnerable to a path traversal that discloses arbitrary files: it inlines images referenced by by joining the src onto the configured base_path with os.path.normpath and opening the result directly, without verifying that the resolved path stays inside base_path. As a result, an src containing ../ sequences or an absolute path reads a file outside base_path as long as it has an allowed image extension (.png, .jpg, .jpeg, .gif, .svg), and the file's contents are then base64-encoded into the rendered output, disclosing them. An application that renders untrusted Markdown with pymdownx.b64 enabled can therefore leak the contents of image-extension files readable by the process to whoever controls the Markdown or views the output, a targeted file-read bounded by the extension check. This issue has been fixed in version 11.0.

Publish Date: 2026-08-06

URL: CVE-2026-61632

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-9xwg-3r6f-jcx2

Release Date: 2026-07-24

Fix Resolution (pymdown-extensions): 11.0

Direct dependency fix Resolution (mkdocs-material): 9.7.7

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2026-45409

Vulnerable Library - idna-3.11-py3-none-any.whl

Internationalized Domain Names in Applications (IDNA)

Library home page: https://files.pythonhosted.org/packages/0e/61/66938bbb5fc52dbdf84594873d5b51fb1f7c7794e9c0f5bd885f30bc507b/idna-3.11-py3-none-any.whl

Sample Path to Dependency File: /docs/Pipfile

Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/docs-1AIbruy1-python/lib/python3.11/site-packages/idna-3.11.dist-info

Dependency Hierarchy:

• mkdocs_material-9.7.6-py3-none-any.whl (Root Library)
  • requests-2.33.0-py3-none-any.whl
    • ❌ idna-3.11-py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 446042fbc4c58f55308d90dae1762e64bf13a474

Found in base branch: develop

Vulnerability Details

Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as ""\u0660" * N" or ""\u30fb" * N + "\u6f22"" utilize the "valid_contexto" function prior to length rejection, and for high values of "N" will take a long time to process. This is the same issue as CVE-2024-3651, however the original remediation in 2024 was not a complete fix. A specially crafted argument to the "idna.encode()" function could consume significant resources. This may lead to a denial-of-service. Starting in version 3.14, the function rejects long inputs as soon as practicable prior to any further processing to minimize resource consumption. In version 3.15, this approach was extended to lesser used alternate functions (i.e. per-label conversions and codec support). A workaround is available. Domain names cannot exceed 253 characters in length. If this length limit is enforced prior to passing the domain to the "idna.encode()" function, it should no longer consume significant resources. This is triggered by arbitrarily large inputs that would not occur in normal usage, but may be passed to the library assuming there is no preliminary input validation by the higher-level application.

Publish Date: 2026-06-05

URL: CVE-2026-45409

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-65pc-fj4g-8rjx

Release Date: 2026-05-19

Fix Resolution: idna - 3.15

CVE-2026-46338

Vulnerable Library - pymdown_extensions-10.21-py3-none-any.whl

Extension pack for Python Markdown.

Library home page: https://files.pythonhosted.org/packages/6f/2c/5b079febdc65e1c3fb2729bf958d18b45be7113828528e8a0b5850dd819a/pymdown_extensions-10.21-py3-none-any.whl

Sample Path to Dependency File: /docs/Pipfile

Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/docs-1AIbruy1-python/lib/python3.11/site-packages/pymdown_extensions-10.21.dist-info

Dependency Hierarchy:

• mkdocs_material-9.7.6-py3-none-any.whl (Root Library)
  • ❌ pymdown_extensions-10.21-py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 446042fbc4c58f55308d90dae1762e64bf13a474

Found in base branch: develop

Vulnerability Details

PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containment check in SnippetPreprocessor.get_snippet_path() in pymdownx/snippets.py when "restrict_base_path: True", allowing markdown snippet directives to read files from sibling paths that share the same base_path prefix, such as docs and docs_internal. This is a regression of CVE-2023-32309. This issue is fixed in version 10.21.3.

Publish Date: 2026-07-16

URL: CVE-2026-46338

CVSS 3 Score Details (4.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-05-20

Fix Resolution: https://github.com/facelessuser/pymdown-extensions.git - 10.21.3,pymdown-extensions - 10.21.3

CVE-2026-4539

Vulnerable Library - pygments-2.19.2-py3-none-any.whl

Pygments is a syntax highlighting package written in Python.

Library home page: https://files.pythonhosted.org/packages/c7/21/705964c7812476f378728bdf590ca4b771ec72385c533964653c68e86bdc/pygments-2.19.2-py3-none-any.whl

Sample Path to Dependency File: /docs/Pipfile

Path to vulnerable library: /tmp/containerbase/cache/.local/share/virtualenvs/docs-1AIbruy1-python/lib/python3.11/site-packages/pygments-2.19.2.dist-info

Dependency Hierarchy:

• mkdocs_material-9.7.6-py3-none-any.whl (Root Library)
  • ❌ pygments-2.19.2-py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 446042fbc4c58f55308d90dae1762e64bf13a474

Found in base branch: develop

Vulnerability Details

A security flaw has been discovered in pygments up to 2.19.2. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular expression complexity. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Publish Date: 2026-03-22

URL: CVE-2026-4539

CVSS 3 Score Details (3.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-5239-wwwm-4pmq

Release Date: 2026-03-22

Fix Resolution: pygments - 2.20.0,pygments - 2.20.0

---

⛑️Automatic Remediation will be attempted for this issue.

[mend-for-github-com]

✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.