CVE-2025-26240: JazzCore python-pdfkit 1.0.0 JavaScript Execution & File Exfiltration

Technical summary

CVE-2025-26240 is a local privilege escalation and arbitrary code execution vulnerability in python-pdfkit 1.0.0. The from_string method fails to properly sanitize or isolate JavaScript execution contexts, permitting attackers to execute code within the server application's security context and access sensitive files on the filesystem. The vulnerability is classified under CWE-120 (Buffer Copy without Checking Size of Input), indicating potential memory safety issues in the underlying processing chain. The CVSS v3.1 score of 8.4 reflects high-impact potential across confidentiality, integrity, and availability with low attack complexity and no privilege requirements.

Business impact

Organizations using python-pdfkit 1.0.0 face significant operational risk. An attacker exploiting this vulnerability could exfiltrate sensitive configuration files, database credentials, API keys, or proprietary data stored on the server. Malicious JavaScript execution could also modify PDF outputs or corrupt application state. For businesses relying on this library for report generation, invoicing, or document processing, a compromise could disrupt operations, trigger data breach notifications, and incur remediation costs. The local attack vector limits exposure in certain deployment models, but containerized or shared hosting environments increase practical risk.

Affected systems

Python-pdfkit version 1.0.0 is affected. Organizations should audit their dependency trees to identify all applications importing this library, including indirect dependencies. The vulnerability does not appear in the provided vendor data, but JazzCore's public repositories and PyPI records should be consulted to confirm whether patch versions are available and what the remediation timeline is.

Exploitability

The attack requires local access to the system running the vulnerable python-pdfkit library—no remote exploitation vector exists. However, exploitation does not require elevated privileges or user interaction, making it accessible to any local user or process. In containerized deployments, lateral movement from a compromised application container could enable exploitation. The from_string method is a core API, so any application using it for user-supplied or semi-trusted input introduces risk. Proof-of-concept details are not disclosed here; security teams should avoid public PoC reproduction without explicit authorization and controlled environment testing.

Remediation

Immediately identify all applications and services using python-pdfkit 1.0.0. Check JazzCore's advisory for patched versions and apply the latest available release. If no patch exists, consider using an alternative PDF generation library or implementing strict input validation and sandboxing measures. For systems that cannot be patched immediately, restrict local access to machines running the vulnerable code and monitor for suspicious file access or JavaScript-like patterns in application logs.

Patch guidance

Verify the latest python-pdfkit release against the official JazzCore repository and PyPI. Update the dependency in your requirements.txt or pyproject.toml and redeploy affected applications. Test functionality in a staging environment first to ensure compatibility. If a patch version number is listed in the vendor advisory, confirm the minimum version required. Organizations should establish a process to receive notifications for future python-pdfkit security updates.

Detection guidance

Monitor system logs and application metrics for unusual local process behavior, especially suspicious file access or child process spawning from the Python interpreter running python-pdfkit. Implement file integrity monitoring on sensitive configuration and credential files. Review application logs for from_string calls with unusual or encoded input patterns. Network detection is limited since the attack is local, but behavioral analysis of processes spawned by the vulnerable library may reveal exploitation attempts. Consider adding security instrumentation to track JavaScript execution contexts within PDF generation workflows.

Why prioritize this

This vulnerability rates as HIGH priority despite its local attack vector because it enables both code execution and data exfiltration with no privilege requirement. python-pdfkit is widely used in web applications, reporting tools, and document services, expanding the blast radius. The combination of high confidentiality, integrity, and availability impact—reflected in the 8.4 CVSS score—demands rapid patching, especially in multi-tenant or containerized environments where lateral movement risk is elevated. Organizations should prioritize patching within 30 days.

Risk score, explained

The CVSS v3.1 score of 8.4 (HIGH) is driven by: (1) Local attack vector (AV:L) limiting reach but not impact once exploited; (2) Low attack complexity (AC:L) indicating no special conditions required; (3) No privileges needed (PR:N); (4) No user interaction (UI:N); (5) Unchanged scope (S:U); (6) High confidentiality, integrity, and availability impact (C:H/I:H/A:H). The absence of complexity and privilege requirements elevates the score despite the local constraint. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of the data snapshot, but the high-impact nature and relatively straightforward exploitation logic suggest rapid adoption by threat actors if public proof-of-concept emerges.

Frequently asked questions