Patch for CVE-2025-51591 #11200
Replies: 3 comments 5 replies
-
|
At first I had no idea what this even is. It contains links to nonexistent sites (or sites not affiliated with this project: pandoc.com, jgm.com). And it seems to contain only an incredibly vague description of an issue with no details. (And it is marked "awaiting analysis.") Finally I found a link to #10682 where the issue is discussed. As noted there, we don't consider this a bug in the code, although pandoc can certainly be misused in ways that create a security issue. We addressed it by adding a note in the Security section of the manual: 67edf7c Our general advice is that people running pandoc on a server should always use the If there are better ideas, I'm all ears. The person who submitted the issue seemed to think that adding something to the Security section was the best approach. |
Beta Was this translation helpful? Give feedback.
-
|
We're working on a theory that CVE-2025-51591 is a duplicate of CVE-2022-35583 with wkhtmltopdf being primarily responsible for the SSRF by fetching iframes (and maybe other remote content like images). Will post more in this discussion thread soon. |
Beta Was this translation helpful? Give feedback.
-
|
No, that's not right. Pandoc itself fetches the content of the iframe. |
Beta Was this translation helpful? Give feedback.
-
|
And I have the same attitude towards the parallel CVE for wkhtmltopdf: This is a command line program. It is not a defect in the program itself if shelling out to it in a web app can cause security problems. The same is true for |
Beta Was this translation helpful? Give feedback.
-
|
There is a CVE for tar (from 2005), with the highest possible exploitability score, which has never been fixed because it's the expected and documented behavior. I think the difference between feature and security issue isn't always clear, at least to me. |
Beta Was this translation helpful? Give feedback.
-
|
I am trying to repro this behavior. test-iframe.html <html>
<p> This text is outside the iframe.</p>
<iframe src="http://localhost:8000/iframe-target.html">
</iframe>
<p> This text is outside the iframe.</p>
</html>iframe-target.html <html>
<title>iframe target</title>
<p>I am text within the iframe target.</p>
</html>I then start a webserver with
seems to strip the embedded whereas
fetches the |
Beta Was this translation helpful? Give feedback.
-
|
Try with: Pandoc seems not to like it when there is whitespace between the iframe open and close tag (this can be fixed). |
Beta Was this translation helpful? Give feedback.
-
|
That worked, thanks. I would also note that when running even though the user has passed |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
I wanted to inquire whether there is any available information regarding the patch for CVE-2025-51591. Additionally, if feasible, could you please associate the CVE identifier with the corresponding commit or issue that addresses the fix? This would greatly assist with tracking and future reference.
Beta Was this translation helpful? Give feedback.
All reactions