CVE-2025-26240

CVSS 8.4 HIGHEPSS 0.4%CWE-120

In JazzCore python-pdfkit 1.0.0, the from_string method enables the execution of JavaScript code within the context of the server application and the exfiltration of local files.

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

n/a · n/a

public PoCs found — 1

githubgithub.com/Habuon/CVE-2025-26240★ 1

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://habuon.github.io/2025/03/12/pdfkit-vulnerability-%28CVE-2025-26240%29.html https://www.csirt.gov.sk/the-python-pdfkit-library-vulnerability.html