CVE-2025-51591

Name	CVE-2025-51591
Description	A Server-Side Request Forgery (SSRF) in JGM Pandoc v3.6.4 allows attackers to gain access to and compromise the whole infrastructure via injecting a crafted iframe. Note: Some users have stated that Pandoc by default can retrieve and parse untrusted HTML content which can enable SSRF vulnerabilities. Using the ‘--sandbox’ option or ‘pandoc-server’ can mitigate such vulnerabilities. Using pandoc with an external ‘--pdf-engine’ can also enable SSRF vulnerabilities, such as CVE-2022-35583 in wkhtmltopdf.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
pandoc (PTS)	bullseye	2.9.2.1-1+deb11u1	vulnerable
	bookworm	2.17.1.1-2~deb12u1	vulnerable
	trixie	3.1.11.1+ds-2	vulnerable
	forky, sid	3.1.11.1+ds-4	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
pandoc	source	(unstable)	(unfixed)	unimportant

Notes

https://github.com/jgm/pandoc/issues/10682
https://github.com/jgm/pandoc/commit/67edf7ce7cd3563a180ae44bd122b012e22364f8
Fix simply updates the documentation