PT-2026-73842

TuxCare rebuilt pdfkit to address 1 CVE. Fixed in 0.6.1.post1+tuxcare...

PYSEC-2026-2860 pdfkit: Path traversal in from_string

In JazzCore python-pdfkit 1.0.0, the fromstring method enables the execution of JavaScript code within the context of the server application and the exfiltration of local files...

django-pdfkit (>=0.1.0, <=0.3.1) potentially affected by CVE-2025-26240 via pdfkit (0.6.0)

pdfkit PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on pdfkit and may be impacted: - django-pdfkit =0.1.0, =0.3.1 Source cves: CVE-2025-26240 Source advisory: OSV:PYSEC-2026-2860...

antipetros-discordbot (>=0.1.0, <=0.1.7), auto-fill-in (0.0.1) +16 more potentially affected by CVE-2025-26240 via pdfkit (0.6.1)

pdfkit PYPI version 0.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on pdfkit and may be impacted: - antipetros-discordbot =0.1.0, =0.20.7, =0.1.0a0, =0.1.0, =0.1.2, =0.0.1, =0.0.1, =0.1.0, =0.0.1a1, =1.0.0, =1.3.1, =1.3.2 and more Source cves:...

a2grunnerp (>=0.1.0, <=0.1.8), agentfoundry (>=1.3.9, <=1.5.95) +207 more potentially affected by CVE-2025-26240 via pdfkit (1.0.0)

pdfkit PYPI version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pdfkit and may be impacted: - a2grunnerp =0.1.0, =1.3.9, =1.2.0, =1.1.3, =0.1.35, =0.1.0, =0.0.1, =0.0.1, =0.5.3, =0.5.5, =0.1.17, =0.2.0, =0.1.0, =0.1.1 and more Source cves:...

pdfkit: Path traversal in from_string

In JazzCore python-pdfkit 1.0.0, the fromstring method enables the execution of JavaScript code within the context of the server application and the exfiltration of local files...

PT-2026-59498

In JazzCore python-pdfkit 1.0.0, the from string method enables the execution of JavaScript code within the context of the server application and the exfiltration of local files...

Linux Distros Unpatched Vulnerability : CVE-2025-26240

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In JazzCore python-pdfkit 1.0.0, the fromstring method enables the execution of JavaScript code within the context of the server application and the exfiltratio...

Buffer Overflow

Overview pdfkit is a Wkhtmltopdf python wrapper to convert html to pdf using the webkit rendering engine and qt Affected versions of this package are vulnerable to Buffer Overflow via the fromstring function. An attacker can execute arbitrary JavaScript code within the server application context...

pdfkit: Path traversal in from_string

In JazzCore python-pdfkit 1.0.0, the fromstring method enables the execution of JavaScript code within the context of the server application and the exfiltration of local files...

antipetros-discordbot (>=0.1.0, <=0.1.7), auto-fill-in (0.0.1) +16 more potentially affected by CVE-2025-26240 via pdfkit (0.6.1)

pdfkit PYPI version 0.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on pdfkit and may be impacted: - antipetros-discordbot =0.1.0, =0.20.7, =0.1.0a0, =0.1.0, =0.1.2, =0.0.1, =0.0.1, =0.1.0, =0.0.1a1, =1.0.0, =1.3.1, =1.3.2 and more Source cves:...

a2grunnerp (>=0.1.0, <=0.1.8), agentfoundry (>=1.3.9, <=1.5.95) +207 more potentially affected by CVE-2025-26240 via pdfkit (1.0.0)

pdfkit PYPI version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pdfkit and may be impacted: - a2grunnerp =0.1.0, =1.3.9, =1.2.0, =1.1.3, =0.1.35, =0.1.0, =0.0.1, =0.0.1, =0.5.3, =0.5.5, =0.1.17, =0.2.0, =0.1.0, =0.1.1 and more Source cves:...

django-pdfkit (>=0.1.0, <=0.3.1) potentially affected by CVE-2025-26240 via pdfkit (0.6.0)

pdfkit PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on pdfkit and may be impacted: - django-pdfkit =0.1.0, =0.3.1 Source cves: CVE-2025-26240 Source advisory: OSV:GHSA-9G3X-6X24-VF9F...

a2grunnerp (>=0.1.0, <=0.1.8), agentfoundry (>=1.3.9, <=1.5.95) +207 more potentially affected by CVE-2025-26240 via pdfkit (1.0.0)

pdfkit PYPI version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pdfkit and may be impacted: - a2grunnerp =0.1.0, =1.3.9, =1.2.0, =1.1.3, =0.1.35, =0.1.0, =0.0.1, =0.0.1, =0.5.3, =0.5.5, =0.1.17, =0.2.0, =0.1.0, =0.1.1 and more Source cves:...

GHSA-9G3X-6X24-VF9F pdfkit: Path traversal in from_string

In JazzCore python-pdfkit 1.0.0, the fromstring method enables the execution of JavaScript code within the context of the server application and the exfiltration of local files...

CVE-2025-26240

In JazzCore python-pdfkit 1.0.0, the fromstring method enables the execution of JavaScript code within the context of the server application and the exfiltration of local files...

DEBIAN-CVE-2025-26240

In JazzCore python-pdfkit 1.0.0, the fromstring method enables the execution of JavaScript code within the context of the server application and the exfiltration of local files...

CVE-2025-26240

In JazzCore python-pdfkit 1.0.0, the fromstring method enables the execution of JavaScript code within the context of the server application and the exfiltration of local files...

UBUNTU-CVE-2025-26240

In JazzCore python-pdfkit 1.0.0, the fromstring method enables the execution of JavaScript code within the context of the server application and the exfiltration of local files...

CVE-2025-26240

In JazzCore python-pdfkit 1.0.0, the fromstring method enables the execution of JavaScript code within the context of the server application and the exfiltration of local files...