Back to KEVs

CVE-2025-51591

A Server-Side Request Forgery (SSRF) in JGM Pandoc v3.6.4 allows attackers to gain access to and compromise the whole infrastructure via injecting...

Basic Information

CVE State
PUBLISHED
Reserved Date
June 16, 2025
Published Date
July 11, 2025
Last Updated
November 24, 2025
Vendor
n/a
Product
n/a
Description
A Server-Side Request Forgery (SSRF) in JGM Pandoc v3.6.4 allows attackers to gain access to and compromise the whole infrastructure via injecting a crafted iframe. Note: Some users have stated that Pandoc by default can retrieve and parse untrusted HTML content which can enable SSRF vulnerabilities. Using the ‘--sandbox’ option or ‘pandoc-server’ can mitigate such vulnerabilities. Using pandoc with an external ‘--pdf-engine’ can also enable SSRF vulnerabilities, such as CVE-2022-35583 in wkhtmltopdf.

CVSS Scores

CVSS v3.1

3.7 - LOW

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC Information

Exploitation
none
Technical Impact
partial

Exploit Status

Exploited in the Wild
Yes (2025-09-25 15:00:07 UTC) Source

References

http://jgm.com http://pandoc.com https://github.com/RealestName/Vulnerability-Research/tree/main/CVE-2025-51591 https://github.com/jgm/pandoc/issues/8874 https://github.com/jgm/pandoc/issues/10682 https://github.com/jgm/pandoc/discussions/11200 https://github.com/jgm/pandoc/issues/11261 https://github.com/jgm/pandoc/pull/11262 https://www.wiz.io/blog/imds-anomaly-hunting-zero-day

Known Exploited Vulnerability Information

Source Added Date
The Shadowserver (via CIRCL) 2025-09-25 15:00:07 UTC

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Added to KEVIntel