What is the CVSS score of CVE-2025-26240?

CVE-2025-26240 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Python are affected by CVE-2025-26240?

JazzCore python-pdfkit 1.0.0 contains a high-severity vulnerability enabling local file disclosure and JavaScript execution through HTML input processing, with publicly available exploit code…

How to fix or mitigate CVE-2025-26240?

Within 24 hours, identify all instances of python-pdfkit 1.0.0 across production, development, and supply-chain systems; immediately restrict PDF generation functions to trusted system components and administrative users only. Within 7 days, implement robust input validation and sanitization for all HTML passed to the from_string method, explicitly rejecting file:// references and JavaScript content, with logging and alerting on rejection attempts. Within 30 days, migrate away from wkhtmltopdf-based solutions to alternative PDF libraries with better security properties, or establish permanent application-level controls ensuring only server-generated, pre-validated HTML is processed, supported by quarterly security testing.

Python CVE-2025-26240

HIGH

Classic Buffer Overflow (CWE-120)

2026-06-17 mitre

GHSA-9g3x-6x24-vf9f

Buffer Overflow Python N A

8.4

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 22:34 vuln.today

CVE Published

Jun 17, 2026 - 00:00 cve.org

HIGH 8.4

CVE Published

Jun 17, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

207 pypi packages depend on pdfkit (185 direct, 24 indirect)

Ecosystem-wide dependent count for version 1.0.0.

DescriptionCVE.org

In JazzCore python-pdfkit 1.0.0, the from_string method enables the execution of JavaScript code within the context of the server application and the exfiltration of local files.

AnalysisAI

Server-side local file disclosure and JavaScript execution in JazzCore python-pdfkit 1.0.0 allows attackers who can influence the HTML passed to the from_string method to run script in the underlying renderer and read arbitrary local files off the host. Because python-pdfkit is a thin wrapper around the wkhtmltopdf binary, injected file:// references and JavaScript are honored during PDF rendering, letting an attacker exfiltrate secrets (config, keys, /etc/passwd) into the generated document. SSVC lists a public proof-of-concept and 'total' technical impact; there is no CISA KEV listing and EPSS is low (0.39%, 31st percentile), so publicly available exploit code exists but no confirmed active exploitation.