Pandoc vulnerabilities
3 known CVE vulnerabilities in Pandoc, translated and rated.
- CVE-2025-51591Low
An SSRF vulnerability in JGM Pandoc v3.6.4 allows attackers to inject a crafted iframe, gaining access to and compromising the entire infrastructure. Pandoc's default behavior of fetching and parsing untrusted HTML can facilitate exploitation of this flaw.
- CVE-2023-38745Medium
Pandoc versions before 3.1.6 allow arbitrary file write, which can be triggered by providing a crafted image element in the input when generating files via the --extract-media option or outputting to PDF format.
- CVE-2023-35936Medium
Pandoc, a Haskell library for converting markup formats, has an arbitrary file write vulnerability that can be triggered by a specially crafted image element in the input. This affects versions from 1.13 to 3.1.4 when generating files using the `--extract-media` option or outputting to PDF format.