Report privately through GitHub's security advisory form rather than opening a public issue.

Expect an acknowledgement within a week. This is maintained on a best-effort basis alongside other work, so a fix may take longer than that — I will say where things stand rather than go quiet.

The latest released version. This is a young package; there are no long-term support branches.

This package opens PDFs, which are untrusted input by nature. Worth reporting:

• A crafted PDF that makes pdfroute crash, hang, or consume unbounded memory. Routing decisions should degrade to a safe default rather than take the process down.
• Anything that executes code, touches the filesystem beyond reading the given file, or makes a network call. This package does none of those and should never start.
• A routing rule that can be made to leak document content anywhere other than the returned decision.

Note that pdfroute only reads page structure — image counts, text block positions, keywords. It never sends a page anywhere. The expensive extractor you route pages to is a separate concern with its own security properties.

• Vulnerabilities in PyMuPDF itself. Report those to the PyMuPDF project; they surface here because it is the parser underneath.
• A page routed to the wrong extractor. That is a tuning question, not a security issue — open a normal issue with the document if you can share it.

Nothing in this package transmits, stores or logs document content. Page statistics and routing decisions stay in memory for the duration of the call.

pdfroute · MIT licensed