PatchSiren cyber security CVE debrief
CVE-2025-26240 JazzCore CVE debrief
A high-severity vulnerability (CVSS Score: 8.4) was discovered in python-pdfkit 1.0.0, enabling the execution of JavaScript code within the server application's context and allowing for the exfiltration of local files. This issue was publicly disclosed on June 17, 2026. The vulnerability is tracked as CVE-2025-26240 and affects the python-pdfkit library. Users of this library should take immediate action to mitigate potential risks. The vulnerability's details are still being reviewed, and its impact is being assessed. No known ransomware campaigns have been associated with this vulnerability. The CVE record and NVD details provide further information on this issue.
- Vendor
- JazzCore
- Product
- python-pdfkit
- CVSS
- HIGH 8.4
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-17
- Original CVE updated
- 2026-06-22
- Advisory published
- 2026-06-17
- Advisory updated
- 2026-06-22
Who should care
Developers and administrators using the python-pdfkit library, especially those integrating it into server applications handling sensitive data, should be aware of this vulnerability. Security teams monitoring for potential JavaScript execution and file exfiltration risks should also prioritize this issue.
Technical summary
The python-pdfkit library, specifically version 1.0.0, is vulnerable to a high-severity issue (CVE-2025-26240) that allows for JavaScript code execution within the server application's context. This vulnerability also enables the exfiltration of local files. The issue arises from the `from_string` method in the library. The CVSS vector for this vulnerability is CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating a high level of severity. The weakness associated with this vulnerability is CWE-120.
Defensive priority
High
Recommended defensive actions
- Update python-pdfkit to a patched version as soon as available
- Restrict the use of the `from_string` method in server applications
- Implement additional security measures to monitor for JavaScript execution and file exfiltration attempts
- Review server application configurations to ensure they do not allow for unintended file access
- Consider alternative libraries for PDF generation that do not have similar vulnerabilities
- Monitor for and apply any security patches related to this vulnerability
- Conduct thorough security audits to identify potential exploitation attempts
Evidence notes
The information provided is based on the CVE record and NVD details. The vulnerability's impact and exploitability are still being assessed. The CVE record and NVD details provide further information on this issue. Additional sources, including security blogs and advisories, may provide further insights into this vulnerability.
Official resources
Publicly disclosed on June 17, 2026.