CVE-2025-26240
published 2026-06-17CVE-2025-26240: In JazzCore python-pdfkit 1.0.0, the from_string method enables the execution of JavaScript code within the context of the server application and the…
PriorityP345high8.4CVSS 3.1
AVLACLPRNUINSUCHIHAH
EPSS
0.39%
32.2th percentile
In JazzCore python-pdfkit 1.0.0, the from_string method enables the execution of JavaScript code within the context of the server application and the exfiltration of local files.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| frappe | frappe | < 15.107.3 | 15.107.3 |
| frappe | frappe | >= 16.0.0-beta.1 < 16.17.0 | 16.17.0 |
| pdfkit_project | pdfkit | 0 – 1.0.0 | — |
CVSS provenance
nvdv3.18.4HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvelistv5v3.18.4HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Frappe Framework 15.x before 15.107.3 and 16.x before 16.17.0 relies on a vulnerable pdfkit library (CVE-2025-26240) for PDF generation, enabling server-side request forgery and local file inclusion.
ghsa_unreviewed·2026-10-13·CVSS 8.4
CVE-2026-109603 [HIGH] CWE-918 Frappe Framework 15.x before 15.107.3 and 16.x before 16.17.0 relies on a vulnerable pdfkit library (CVE-2025-26240) for PDF generation, enabling server-side request forgery and local file inclusion.
Frappe Framework 15.x before 15.107.3 and 16.x before 16.17.0 relies on a vulnerable pdfkit library (CVE-2025-26240) for PDF generation, enabling server-side request forgery and local file inclusion. Authenticated attackers can supply crafted content to PDF rendering to make the server fetch internal resources or embed local server files in generated PDFs.
VulDB
JazzCore Python-pdfkit 1.0.0 from_string privilege escalation
vuldb·2026-06-17
CVE-2025-26240 [CRITICAL] JazzCore Python-pdfkit 1.0.0 from_string privilege escalation
A vulnerability, which was classified as critical, has been found in JazzCore Python-pdfkit 1.0.0. Affected by this issue is the function from_string. The manipulation leads to privilege escalation.
This vulnerability is referenced as CVE-2025-26240. The attack needs to be initiated within the local network. No exploit is available.
GHSA
pdfkit: Path traversal in from_string
ghsa·2026-06-17
CVE-2025-26240 [HIGH] CWE-120 pdfkit: Path traversal in from_string
pdfkit: Path traversal in from_string
In JazzCore python-pdfkit 1.0.0, the from_string method enables the execution of JavaScript code within the context of the server application and the exfiltration of local files.
CVEList
CVE-2025-26240: In JazzCore python-pdfkit 1
cvelistv5·2026-06-17·CVSS 8.4
CVE-2025-26240 [HIGH] CVE-2025-26240: In JazzCore python-pdfkit 1
In JazzCore python-pdfkit 1.0.0, the from_string method enables the execution of JavaScript code within the context of the server application and the exfiltration of local files.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2025-26240 python-pdfkit: python-pdfkit: Arbitrary Code Execution and Information Disclosure [fedora-all]
bugzilla·2026-08-06·CVSS 8.4
CVE-2025-26240 [HIGH] CVE-2025-26240 python-pdfkit: python-pdfkit: Arbitrary Code Execution and Information Disclosure [fedora-all]
CVE-2025-26240 python-pdfkit: python-pdfkit: Arbitrary Code Execution and Information Disclosure [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In JazzCore python-pdfkit 1.0.0, the from_string method enables the execution of JavaScript code within the context of the server application and the exfiltration of local files.
Bugzilla
CVE-2025-26240 python-pdfkit: python-pdfkit: Arbitrary Code Execution and Information Disclosure
bugzilla·2026-06-17·CVSS 8.4
CVE-2025-26240 [HIGH] CVE-2025-26240 python-pdfkit: python-pdfkit: Arbitrary Code Execution and Information Disclosure
CVE-2025-26240 python-pdfkit: python-pdfkit: Arbitrary Code Execution and Information Disclosure
In JazzCore python-pdfkit 1.0.0, the from_string method enables the execution of JavaScript code within the context of the server application and the exfiltration of local files.
2026-06-17
Published