PT-2026-59498 · Pypi · Pdfkit

Published 2026-07-13 · Updated 2026-07-13

OSV

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In JazzCore python-pdfkit 1.0.0, the from string method enables the execution of JavaScript code within the context of the server application and the exfiltration of local files.

Fix

Related Identifiers

PYSEC-2026-2860

Affected Products

Pdfkit

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-26240 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-2860 · Vendor Advisory
• https://github.com/JazzCore/python-pdfkit · Note
• https://pypi.org/project/pdfkit · Note
• https://habuon.github.io/2025/03/12/pdfkit-vulnerability-%28CVE-2025-26240%29.html · Note
• https://csirt.gov.sk/the-python-pdfkit-library-vulnerability.html · Note
• https://github.com/advisories/GHSA-9g3x-6x24-vf9f · Note