Skip to content

Security notes update #11262

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
eoinwm-cisa wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Security notes update #11262

eoinwm-cisa wants to merge 1 commit into from
+37 −13

Conversation

@eoinwm-cisa
Copy link

@eoinwm-cisa eoinwm-cisa commented Oct 30, 2025

We did some analysis regarding SSRF vulnerabilities (CVE-2025-51591, CVE-2022-35583) and came up with suggested changes for the documentation.

Related: #11261 #10682 #8874 #11200

@amanion-cisa
Copy link

amanion-cisa commented Oct 30, 2025

CC @dw4rren.

@jgm
Copy link
Owner

jgm commented Nov 30, 2025

It would be good to know if any of the other via-HTML pdf-engines are subject to the same problem as wkhtmltopdf. That would allow more useful guidance.

@yanntrividic
Copy link
Contributor

yanntrividic commented Dec 28, 2025

It would be good to know if any of the other via-HTML pdf-engines are subject to the same problem as wkhtmltopdf. That would allow more useful guidance.

WeasyPrint, when correctly configured, is not subject to the SSRF vulnerability (Kozea/WeasyPrint#1288, ping @liZe).

I don't know if is the case for pagedjs-cli though, as I have not found anything on the repos about this. Maybe @fchasen or @julientaq know?

@liZe
Copy link

liZe commented Dec 28, 2025

WeasyPrint does not support iframes at all, so it should be safe with this one.

@zmanion
Copy link

zmanion commented Jan 8, 2026 •
edited
Loading

In our testing, pagedjs-cli is vulnerable similarly to wkhtmltopdf:

pandoc -o output.pdf input.html -f html+raw_html --pdf-engine pagedjs-cli
pandoc -o output.pdf input.md --pdf-engine pagedjs-cli

prince is not vulnerable by default but can be made vulnerable using the --iframes option:

pandoc -f html+raw_html --pdf-engine prince --pdf-engine-opt=--iframes -o out.pdf input.html

Edit: CVE-2018-19858 looks like the PrinceXML analog to CVE-2022-35583 for wkhtmltopdf.

input.html and input.md contain something like:

<html><iframe src=http://internal-webserver:8000/sensitive-data.html /></html>

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@eoinwm-cisa @amanion-cisa @jgm @yanntrividic @liZe @zmanion