CVE-2025-51591

Published Jul 11, 2025

Last updated 2 days ago

JGM Pandoc

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-51591 is a Server-Side Request Forgery (SSRF) vulnerability found in JGM Pandoc version 3.6.4. It stems from Pandoc's rendering of `<iframe>` tags in HTML documents. An attacker can inject a crafted HTML iframe element to target the AWS Instance Metadata Service (IMDS) endpoint or other private resources. By exploiting this vulnerability, attackers can potentially compromise a target system. They can craft an `<iframe>` that points to the IMDS server (169.254.169.254) to try and access sensitive information, such as temporary, short-lived credentials associated with an IAM role. This can allow the attacker to harvest temporary credentials without needing direct host access.

Description: A Server-Side Request Forgery (SSRF) in JGM Pandoc v3.6.4 allows attackers to gain access to and compromise the whole infrastructure via injecting a crafted iframe.
Source: cve@mitre.org
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 6.5
Impact score: 4.2
Exploitability score: 2.2
Vector string: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Severity: MEDIUM

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-918

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 50

References