CVE-2025-26240 pdfkit: Path traversal in from_string
Attackers can execute arbitrary JavaScript and read local files via the from_string method in python-pdfkit, requiring an upgrade to mitigate.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-26240?
CVE-2025-26240 is a high-severity code injection vulnerability in n/a, published on 17 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In JazzCore python-pdfkit 1.0.0, the from_string method enables the execution of JavaScript code within the context of the server application and the exfiltration of local files.
Weakness: CWE-120
Which versions are affected by CVE-2025-26240?
3 open source packages ship an affected version, including pdfkit.
| Package | Affected | Fixed in |
|---|---|---|
pdfkit PyPI | All versions to 1.0.0 | None |
pdfkit PyPI | All versions to 1.0.0 | None |
pdfkit PyPI | All versions to 1.0.0 | None |
How do I fix CVE-2025-26240?
Upgrade to a fixed version.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-26240 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-26240 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as CLSA-2026-1772496734, DEBIAN-CVE-2025-26240, GHSA-9g3x-6x24-vf9f, PYSEC-2026-2860, UBUNTU-CVE-2025-26240.