HIGH 8.4

GHSA-9g3x-6x24-vf9f

pdfkit: Path traversal in from_string

Details

In JazzCore python-pdfkit 1.0.0, the from_string method enables the execution of JavaScript code within the context of the server application and the exfiltration of local files.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI / pdfkit

Introduced in: 0

No fixed version published yet for pdfkit (pip). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-26240 [ADVISORY]
https://github.com/JazzCore/python-pdfkit [PACKAGE]
https://habuon.github.io/2025/03/12/pdfkit-vulnerability-%28CVE-2025-26240%29.html [WEB]
https://www.csirt.gov.sk/the-python-pdfkit-library-vulnerability.html [WEB]