GHSA-9g3x-6x24-vf9f

pdfkit: Path traversal in from_string

Source: GitHub Advisory Database (reviewed) High CVE-2025-26240

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	pdfkit	<= 1.0.0	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

In JazzCore python-pdfkit 1.0.0, the from_string method enables the execution of JavaScript code within the context of the server application and the exfiltration of local files.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-26240 advisory
https://github.com/JazzCore/python-pdfkit package
https://habuon.github.io/2025/03/12/pdfkit-vulnerability-%28CVE-2025-26240%29.html web
https://www.csirt.gov.sk/the-python-pdfkit-library-vulnerability.html web