md-to-pdf vulnerable to arbitrary JavaScript code execution when parsing front matter

Summary A Markdown front-matter block that contains JavaScript delimiter causes the JS engine in gray-matter library to execute arbitrary code in the Markdown to PDF converter process of md-to-pdf library, resulting in remote code execution. Details md-to-pdf uses the gray-matter library to parse...

mpdf-pocs

mPDF 8.2.6 PoCs Referenced by: - https:/...

Astra Linux - уязвимость в pypdf2

pypdf is an open source, pure-python PDF library. In affected versions an attacker may craft a PDF which leads to an infinite loop if parsecontentstream is executed. That is, for example, the case if the user extracted text from such a PDF. This issue was introduced in pull request 969 and resolv...

GHSA-VR63-X8VC-M265 pypdf possibly loops infinitely when reading DCT inline images without EOF marker

Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page which has an inline image using the DCTDecode filter. Patches This has been fixed in pypdf==6.1.3. Workarounds If you cannot upgrade yet, consider...

EUVD-2018-12811

Malware in sbrugna...

EUVD-2018-12812

Malware in sbrugna...

The vulnerability of theutils/pdfdetach.cc component in the Poppler PDF rendering library allows a attacker to cause a service failure.

The vulnerability of theutils/pdfdetach.cc component in the Poppler PDF rendering library is related to pointer manipulation errors. Exploiting this vulnerability could allow an attacker to cause service interruptions...

EUVD-2025-19742

Malicious code in bioql PyPI...

The vulnerability of the pdf.js library in the NaumenKMS knowledge management system, related to the lack of protective measures for the web page structure, allows attackers to execute arbitrary JavaScript code.

The vulnerability of the pdf.js library in the Knowledge Management System NaumenKMS is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability could allow a malicious actor to execute arbitrary JavaScript code remotely...

ROS-20250910-02

A vulnerability in the Hints::Hints poppler/Hints.cc function of the Poppler PDF display library is related to a resource release error. with resource release errors. Exploitation of the vulnerability allows an attacker acting remotely, to cause a denial of service using a specially crafted PDF...

The vulnerability of the PHP library TCPDF, related to the inefficient complexity of regular expressions, allows attackers to trigger a service failure.

The vulnerability of the PHP library TCPDF is related to insufficient validation of input data during the analysis of unreliable SVG files. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

The vulnerability of the PHP library TCPDF, related to the failure to remove script-related HTML tags from web pages, allows attackers to perform cross-site scripting (XSS) attacks.

The vulnerability of the PHP library TCPDF is related to the lack of measures taken to eliminate script-related HTML tags on web pages. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS...

libQt5Pdf5-5.15.19-1.1 on GA media (moderate)

libQt5Pdf5-5.15.19-1.1 on GA media Announcement ID: openSUSE-SU-2025:15531-1 Rating: moderate Cross-References: CVE-2024-10229 CVE-2024-10827 CVE-2024-11477 CVE-2024-12694 CVE-2024-55549 CVE-2025-0436 CVE-2025-0762 CVE-2025-0996 CVE-2025-0999 CVE-2025-1426 CVE-2025-1919 CVE-2025-2136 CVE-2025-242...

Linux Distros Unpatched Vulnerability : CVE-2018-17057

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in TCPDF before 6.2.22. Attackers can trigger deserialization of arbitrary data via the phar:// wrapper. CVE-2018-17057 Note that Nessus...

pypdf 安全漏洞

pypdf is py-pdf open source a free open source pure python PDF library . The ability to split, merge, crop and convert pages of a PDF file. A security vulnerability exists in pypdf versions prior to 6.0.0, which stems from the fact that a malicious PDF could lead to RAM exhaustion, affecting...

DEBIAN-CVE-2025-54869

FPDI is a collection of PHP classes that facilitate reading pages from existing PDF documents and using them as templates in FPDF. In versions 2.6.2 and below, any application that uses FPDI to process user-supplied PDF files is at risk, causing a Denial of Service DoS vulnerability. An attacker...

CVE-2025-52886

Poppler is a PDF rendering library. Versions prior to 25.06.0 use std::atomicint for reference counting. Because std::atomicint is only 32 bits, it is possible to overflow the reference count and trigger a use-after-free. Version 25.06.0 patches the issue...

CVE-2025-52886 Poppler Use After Free Vulnerability

Poppler is a PDF rendering library. Versions prior to 25.06.0 use std::atomicint for reference counting. Because std::atomicint is only 32 bits, it is possible to overflow the reference count and trigger a use-after-free. Version 25.06.0 patches the issue...

CVE-2023-36810

pypdf is a pure-python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime. This quadratic runtime blocks the current process and can utilize a single core of t...

poppler security update

An update is available for poppler. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Poppler is a Portable Document Format PDF rendering library, used by...