CVE-2025-26240

High

In JazzCore python-pdfkit 1.0.0, the from_string method enables the execution of JavaScript code within the context of the server…

mitre·CWE-22·Published 2026-06-17

CVSS

8.4

EPSS

—

KEV

Exploits

cve.orgen

178 chars

In JazzCore python-pdfkit 1.0.0, the from_string method enables the execution of JavaScript code within the context of the server application and the exfiltration of local files.

GHSAen

178 chars

In JazzCore python-pdfkit 1.0.0, the from_string method enables the execution of JavaScript code within the context of the server application and the exfiltration of local files.

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
3.1	Primary	cve.org	8.4	—	—	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3.1	Secondary	GHSA	8.4	—	—	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H