debian/pandoc vulnerabilities

Latest debian/pandoc CVEs

Newest publication first

1. CVE-2025-51591 A Server-Side Request Forgery (SSRF) in JGM Pandoc v3.6.4 allows attackers to gain access to and compromise the whole infrastructure via injecting a crafted iframe. Note: Some users have stated that P...

   Published 2025-07-11

   Low·CVSS 3.7 EPSS 0.74%

   A Server-Side Request Forgery (SSRF) in JGM Pandoc v3.6.4 allows attackers to gain access to and compromise the whole infrastructure via injecting a crafted iframe. Note: Some users have stated that Pandoc by default can retrieve and parse untrusted HTML content which can enable...

2. DLA-3507-1 pandoc - security update

   Published 2023-07-25

   Unknown

3. CVE-2023-38745 Pandoc before 3.1.6 allows arbitrary file write: this can be triggered by providing a crafted image element in the input when generating files via the --extract-media option or outputting to PDF forma...

   Published 2023-07-25

   Medium·CVSS 6.3 EPSS 0.25%

   Pandoc before 3.1.6 allows arbitrary file write: this can be triggered by providing a crafted image element in the input when generating files via the --extract-media option or outputting to PDF format. This allows an attacker to create or overwrite arbitrary files, depending on...

4. CVE-2023-35936 Arbitrary file write is possible in Pandoc when using PDF output or --extract-media with untrusted input

   Published 2023-07-05

   Medium·CVSS 5.0 EPSS 0.37%

   Pandoc is a Haskell library for converting from one markup format to another, and a command-line tool that uses this library. Starting in version 1.13 and prior to version 3.1.4, Pandoc is susceptible to an arbitrary file write vulnerability, which can be triggered by providing a...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.