PyPI/pdfkit CVE-2025-26240: high 8.4, EPSS 0.39%
pdfkit: Path traversal in from_string
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 1.0.0 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-9g3x-6x24-vf9f
- https://nvd.nist.gov/vuln/detail/CVE-2025-26240
- https://github.com/JazzCore/python-pdfkit
- https://habuon.github.io/2025/03/12/pdfkit-vulnerability-%28CVE-2025-26240%29.html
- https://www.csirt.gov.sk/the-python-pdfkit-library-vulnerability.html
CVE-2025-26240 · published · modified · JSON