CVE-2025-26240

Description

In JazzCore python-pdfkit 1.0.0, the from_string method enables the execution of JavaScript code within the context of the server application and the exfiltration of local files.

Traduire en français

Scores CVSS

Faiblesses (CWE)

• CWE-120

Références

• https://habuon.github.io/2025/03/12/pdfkit-vulnerability-%28CVE-2025-26240%29.html
• https://www.csirt.gov.sk/the-python-pdfkit-library-vulnerability.html
• https://habuon.github.io/2025/03/12/pdfkit-vulnerability-%28CVE-2025-26240%29.html

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories