PT-2026-59498 · Pypi · Pdfkit

Publicado 2026-07-13 · Atualizado 2026-07-13

OSV

CVSS v3.1

8.4

Alta

Vetor base

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In JazzCore python-pdfkit 1.0.0, the from string method enables the execution of JavaScript code within the context of the server application and the exfiltration of local files.

Correção

Identificadores relacionados

PYSEC-2026-2860

Produtos afetados

Pdfkit

Referências · 7

• https://github.com/JazzCore/python-pdfkit · Nota
• https://pypi.org/project/pdfkit · Nota
• https://habuon.github.io/2025/03/12/pdfkit-vulnerability-%28CVE-2025-26240%29.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-26240 · Nota de Segurança
• https://csirt.gov.sk/the-python-pdfkit-library-vulnerability.html · Nota
• https://osv.dev/vulnerability/PYSEC-2026-2860 · Aviso do Fabricante
• https://github.com/advisories/GHSA-9g3x-6x24-vf9f · Nota