CVE-2025-51591
LOWCVSS v3.1: 3.7 · EPSS: 0.0063 (45.9 percentile)
Source data as of:
At a glance
- Severity
- LOW
- CVSS
- 3.7 v3.1 · NVD
- EPSS
- 0.0063 (45.9 percentile) · FIRST.org
- CISA KEV
- No
- Type
- SSRF · NVD CWE
- Attack conditions (CVSS vector)
- NetworkNo privilegesNo user interaction · Source: NVD Vector
- Published
- 2025-07-11 · Modified: 2026-07-05
- References
- Jump to references (8)
CVSS / EPSS / KEV
Source — CVSS: NVD · EPSS: FIRST.org · KEV: CISA. Data & Sources
Description
A Server-Side Request Forgery (SSRF) in JGM Pandoc v3.6.4 allows attackers to gain access to and compromise the whole infrastructure via injecting a crafted iframe. Note: Some users have stated that Pandoc by default can retrieve and parse untrusted HTML content which can enable SSRF vulnerabilities. Using the ‘--sandbox’ option or ‘pandoc-server’ can mitigate such vulnerabilities. Using pandoc with an external ‘--pdf-engine’ can also enable SSRF vulnerabilities, such as CVE-2022-35583 in wkhtmltopdf.
References
Reference URLs as listed by NVD, grouped by a mechanical match on the link's host/pattern. Labels describe the link type only.
- Reference http://pandoc.com
- Reference https://github.com/RealestName/Vulnerability-Research/tree/main/CVE-2025-51591
- Reference https://github.com/jgm/pandoc/discussions/11200
- Reference https://github.com/jgm/pandoc/issues/10682
- Reference https://github.com/jgm/pandoc/issues/11261
- Reference https://github.com/jgm/pandoc/issues/8874
- Reference https://github.com/jgm/pandoc/pull/11262
- Reference https://www.wiz.io/blog/imds-anomaly-hunting-zero-day