PYSEC-2026-2860
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/pdfkit/PYSEC-2026-2860.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2026-2860
- Aliases
-
- CVE-2025-26240
- GHSA-9g3x-6x24-vf9f
- Published
- 2026-07-13T15:46:20.237675Z
- Modified
- 2026-07-13T16:32:54.747129708Z
- Severity
-
- 8.4 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- pdfkit: Path traversal in from_string
- Details
-
In JazzCore python-pdfkit 1.0.0, the from_string method enables the execution of JavaScript code within the context of the server application and the exfiltration of local files.
- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2025-26240
- https://github.com/JazzCore/python-pdfkit
- https://habuon.github.io/2025/03/12/pdfkit-vulnerability-%28CVE-2025-26240%29.html
- https://www.csirt.gov.sk/the-python-pdfkit-library-vulnerability.html
- https://pypi.org/project/pdfkit
- https://github.com/advisories/GHSA-9g3x-6x24-vf9f
Affected packages
PyPI / pdfkit
Package
- Name
- pdfkit
- View open source insights on deps.dev
- Purl
- pkg:pypi/pdfkit