{"id":"CVE-2025-26240","title":"In JazzCore python-pdfkit 1.0.0, the from_string method enables the execution of JavaScript code within the context of the server application and the exfiltration of local files.","summary":"In JazzCore python-pdfkit 1.0.0, the from_string method enables the execution of JavaScript code within the context of the server application and the exfiltration of local files.","severity":"high","cvss":8.4,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-120","CWE-22"],"vendor":"pdfkit","product":"pdfkit","affected":["pdfkit <= 1.0.0"],"published":"2026-06-17","updated":"2026-10-12","sourceUpdated":"2026-10-12T22:10:00.247","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-26240","references":[{"url":"https://habuon.github.io/2025/03/12/pdfkit-vulnerability-%28CVE-2025-26240%29.html","label":"cve@mitre.org"},{"url":"https://www.csirt.gov.sk/the-python-pdfkit-library-vulnerability.html","label":"cve@mitre.org"},{"url":"https://habuon.github.io/2025/03/12/pdfkit-vulnerability-%28CVE-2025-26240%29.html","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-26240"},{"url":"https://github.com/advisories/GHSA-9g3x-6x24-vf9f"}],"tags":["nvd","exploit-available","ghsa","pip"],"epss":0.00392,"epssPercentile":0.33179,"exploits":{"github":1,"githubRepos":["https://github.com/Habuon/CVE-2025-26240"],"checkedAt":"2026-10-27T16:50:48.365Z"},"exploitAvailable":true,"ecosystem":"pip","ingestedAt":"2026-06-29T14:31:47.201Z","slug":"CVE-2025-26240","body":"## Overview\n\nIn JazzCore python-pdfkit 1.0.0, the from_string method enables the execution of JavaScript code within the context of the server application and the exfiltration of local files.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2025-26240)\n\nAffected packages:\n\n- `pdfkit <= 1.0.0`\n\nSource: https://github.com/advisories/GHSA-9g3x-6x24-vf9f","depth":"midnight","depthScore":58,"depthScoreParts":{"impact":46.2,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":4887,"id":"CVE-2025-26240","ts":1788887214668,"field":"exploit_available","old":"false","new":"true"},{"seq":3770,"id":"CVE-2025-26240","ts":1788886332574,"field":"exploit_available","old":"true","new":"false"},{"seq":2615,"id":"CVE-2025-26240","ts":1788883012483,"field":"exploit_available","old":"false","new":"true"},{"seq":1644,"id":"CVE-2025-26240","ts":1788882414844,"field":"exploit_available","old":"true","new":"false"},{"seq":752,"id":"CVE-2025-26240","ts":1788881850119,"field":"exploit_available","old":"false","new":"true"}]}