CVE-2025-51591

A Server-Side Request Forgery (SSRF) in JGM Pandoc v3.6.4 allows attackers to gain access to and compromise the whole infrastructure via injecting a crafted iframe. Note: Some users have stated that Pandoc by default can retrieve and parse untrusted HTML content which can enable SSRF vulnerabilities. Using the ‘--sandbox’ option or ‘pandoc-server’ can mitigate such vulnerabilities. Using pandoc with an external ‘--pdf-engine’ can also enable SSRF vulnerabilities, such as CVE-2022-35583 in wkhtmltopdf.

• CWE-918

• https://github.com/RealestName/Vulnerability-Research/tree/main/CVE-2025-51591
• https://github.com/jgm/pandoc/discussions/11200
• https://github.com/jgm/pandoc/issues/10682
• https://github.com/jgm/pandoc/issues/11261
• https://github.com/jgm/pandoc/issues/8874
• https://github.com/jgm/pandoc/pull/11262
• https://www.wiz.io/blog/imds-anomaly-hunting-zero-day
• https://github.com/jgm/pandoc/commit/67edf7ce7cd3563a180ae44bd122b012e22364f8
• https://github.com/jgm/pandoc/issues/10682
• https://pandoc.org
• https://www.wiz.io/blog/imds-anomaly-hunting-zero-day
• not-applicable:http://jgm.com/
• not-applicable:http://pandoc.com/

Published

Jul 11, 2025

Last Modified

Jul 5, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-51567A SQL Injection was found in the /exam/user/profile.php page…9.1
• CVE-2025-51569A cross-site scripting (XSS) vulnerability exists in the LB-…6.1
• CVE-2025-5157A vulnerability was found in H3C SecCenter SMP-E1114P02 up t…7.5
• CVE-2025-5158A vulnerability was found in H3C SecCenter SMP-E1114P02 up t…7.5
• CVE-2025-51586An issue was discoverd in file controllers/admin/AdminLoginC…3.7
• CVE-2025-5159A vulnerability was found in H3C SecCenter SMP-E1114P02 up t…7.5
• CVE-2025-5160A vulnerability classified as problematic has been found in …7.5
• CVE-2025-51602mmstu.c in VideoLAN VLC media player before 3.0.22 allows an…4.8
• CVE-2025-51605An issue was discovered in Shopizer 3.2.7. The server's CORS…8.1
• CVE-2025-51606hippo4j 1.0.0 to 1.5.0, uses a hard-coded secret key in its …8.8
• CVE-2025-5161A vulnerability classified as problematic was found in H3C S…7.5
• CVE-2025-5162A vulnerability, which was classified as critical, has been …9.8