p PatchFirst

CVE-2025-26240

CVE-2025-26240

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In JazzCore python-pdfkit 1.0.0, the from_string method enables the execution of JavaScript code within the context of the server application and the exfiltration of local files.

CVSS 8.4 · High · EPSS 0.4%

Published
Updated

Stack: system · python

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • pdfkit Debian:12

    Versions
    • 1.0.0-2
    • 1.0.0-3
    • 1.0.0-4
    • 1.0.0-5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pdfkit PyPI

    Versions
    • 0.2.3
    • 0.2.4
    • 0.3.0
    • 0.4.0
    • 0.4.1
    • 0.5.0
    • 0.6.0
    • 0.6.1
    • 1.0.0
    Affected ranges
    • ECOSYSTEM: ≤ 1.0.0

    No fix published

  • pdfkit Ubuntu:18.04:LTS

    Versions
    • 0.5.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pdfkit Ubuntu:20.04:LTS

    Versions
    • 0.6.1-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pdfkit Ubuntu:22.04:LTS

    Versions
    • 0.6.1-2
    • 1.0.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • pdfkit Ubuntu:24.04:LTS

    Versions
    • 1.0.0-2
    • 1.0.0-3
    • 1.0.0-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →