Skip to content

Security notes update#11262

Open
eoinwm-cisa wants to merge 1 commit into
jgm:mainfrom
eoinwm-cisa:doc-update
Open

Security notes update#11262
eoinwm-cisa wants to merge 1 commit into
jgm:mainfrom
eoinwm-cisa:doc-update

Conversation

@eoinwm-cisa
Copy link
Copy Markdown

@eoinwm-cisa eoinwm-cisa commented Oct 30, 2025

We did some analysis regarding SSRF vulnerabilities (CVE-2025-51591, CVE-2022-35583) and came up with suggested changes for the documentation.

Related: #11261 #10682 #8874 #11200

@amanion-cisa
Copy link
Copy Markdown

amanion-cisa commented Oct 30, 2025

CC @dw4rren.

@jgm
Copy link
Copy Markdown
Owner

jgm commented Nov 30, 2025

It would be good to know if any of the other via-HTML pdf-engines are subject to the same problem as wkhtmltopdf. That would allow more useful guidance.

@yanntrividic
Copy link
Copy Markdown
Contributor

yanntrividic commented Dec 28, 2025

It would be good to know if any of the other via-HTML pdf-engines are subject to the same problem as wkhtmltopdf. That would allow more useful guidance.

WeasyPrint, when correctly configured, is not subject to the SSRF vulnerability (Kozea/WeasyPrint#1288, ping @liZe).

I don't know if is the case for pagedjs-cli though, as I have not found anything on the repos about this. Maybe @fchasen or @julientaq know?

@liZe
Copy link
Copy Markdown

liZe commented Dec 28, 2025

WeasyPrint does not support iframes at all, so it should be safe with this one.

@zmanion
Copy link
Copy Markdown

zmanion commented Jan 8, 2026 •
edited
Loading

In our testing, pagedjs-cli is vulnerable similarly to wkhtmltopdf:

pandoc -o output.pdf input.html -f html+raw_html --pdf-engine pagedjs-cli
pandoc -o output.pdf input.md --pdf-engine pagedjs-cli

prince is not vulnerable by default but can be made vulnerable using the --iframes option:

pandoc -f html+raw_html --pdf-engine prince --pdf-engine-opt=--iframes -o out.pdf input.html

Edit: CVE-2018-19858 looks like the PrinceXML analog to CVE-2022-35583 for wkhtmltopdf.

input.html and input.md contain something like:

<html><iframe src=http://internal-webserver:8000/sensitive-data.html /></html>

jgm
jgm reviewed Jun 1, 2026
View reviewed changes
Comment thread MANUAL.txt
title: Pandoc User's Guide
author: John MacFarlane
date: 2026-03-19
date: 2025-10-30
Copy link
Copy Markdown
Owner

@jgm jgm Jun 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

do not change this; I will change before a release

jgm
jgm reviewed Jun 1, 2026
View reviewed changes
Comment thread MANUAL.txt
Comment on lines +1751 to 1753
pandoc does not include a defaults file. The tables below are examples
and do not document default configuration options.

Copy link
Copy Markdown
Owner

@jgm jgm Jun 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is an extraneous change and shouldn't be part of this PR.

jgm
jgm reviewed Jun 1, 2026
View reviewed changes
Comment thread MANUAL.txt
Comment on lines 7849 to 7852
Copy link
Copy Markdown
Owner

@jgm jgm Jun 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No reason to change the heading

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jgm jgm jgm left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@eoinwm-cisa @amanion-cisa @jgm @yanntrividic @liZe @zmanion