CVE-2025-51591

{"id": "CVE-2025-51591", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.2}]}, "published": "2025-07-11T14:15:27.347", "references": [{"url": "http://jgm.com", "source": "[email protected]"}, {"url": "http://pandoc.com", "source": "[email protected]"}, {"url": "https://github.com/RealestName/Vulnerability-Research/tree/main/CVE-2025-51591", "source": "[email protected]"}, {"url": "https://github.com/jgm/pandoc/discussions/11200", "source": "[email protected]"}, {"url": "https://github.com/jgm/pandoc/issues/10682", "source": "[email protected]"}, {"url": "https://github.com/jgm/pandoc/issues/11261", "source": "[email protected]"}, {"url": "https://github.com/jgm/pandoc/issues/8874", "source": "[email protected]"}, {"url": "https://github.com/jgm/pandoc/pull/11262", "source": "[email protected]"}, {"url": "https://www.wiz.io/blog/imds-anomaly-hunting-zero-day", "source": "[email protected]"}, {"url": "https://github.com/jgm/pandoc/commit/67edf7ce7cd3563a180ae44bd122b012e22364f8", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}, {"url": "https://github.com/jgm/pandoc/issues/10682", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}, {"url": "https://pandoc.org", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}, {"url": "https://www.wiz.io/blog/imds-anomaly-hunting-zero-day", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}, {"url": "not-applicable:http://jgm.com/", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}, {"url": "not-applicable:http://pandoc.com/", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "A Server-Side Request Forgery (SSRF) in JGM Pandoc v3.6.4 allows attackers to gain access to and compromise the whole infrastructure via injecting a crafted iframe. Note: Some users have stated that Pandoc by default can retrieve and parse untrusted HTML content which can enable SSRF vulnerabilities. Using the \u2018--sandbox\u2019 option or \u2018pandoc-server\u2019 can mitigate such vulnerabilities. Using pandoc with an external \u2018--pdf-engine\u2019 can also enable SSRF vulnerabilities, such as CVE-2022-35583 in wkhtmltopdf."}, {"lang": "es", "value": "Server-Side Request Forgery (SSRF) en JGM Pandoc v3.6.4 permite a los atacantes obtener acceso y comprometer toda la infraestructura mediante la inyecci\u00f3n de un iframe manipulado espec\u00edficamente."}], "lastModified": "2025-11-24T22:15:48.747", "sourceIdentifier": "[email protected]"}