CVE-2023-35936
Arbitrary file write is possible in Pandoc when using PDF output or --extract-media with untrusted input
- Published
- Updated
- Reserved
- Assigned by
- GitHub_M
Description
Pandoc is a Haskell library for converting from one markup format to another, and a command-line tool that uses this library. Starting in version 1.13 and prior to version 3.1.4, Pandoc is susceptible to an arbitrary file write vulnerability, which can be triggered by providing a specially crafted image element in the input when generating files using the `--extract-media` option or outputting to PDF format. This vulnerability allows an attacker to create or overwrite arbitrary files on the system ,depending on the privileges of the process running pandoc. It only affects systems that pass untrusted user input to pandoc and allow pandoc to be used to produce a PDF or with the `--extract-media` option. The fix is to unescape the percent-encoding prior to checking that the resource is not above the working directory, and prior to extracting the extension. Some code for checking that the path is below the working directory was flawed in a similar way and has also been fixed. Note that the `--sandbox` option, which only affects IO done by readers and writers themselves, does not block this vulnerability. The vulnerability is patched in pandoc 3.1.4. As a workaround, audit the pandoc command and disallow PDF output and the `--extract-media` option.
Timeline
ID reserved
By GitHub_M
- 15 days later
· 15 days later
Published
- 20 months later
· 20 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | Medium6.0 | CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:L |
| NVDNVD · Modified | 3.1 | Medium5.0 | CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:L |
- EPSS (exploitation in 30 days)
- 0.37% · top 69% of all CVEs (7 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.0.
Weakness
Affected products
References (5)
- https://github.com/jgm/pandoc/security/advisories/GHSA-xj5q-fv23-575g (opens in a new tab)x_refsource_CONFIRMx_transferred
- https://lists.debian.org/debian-lts-announce/2023/07/msg00029.html (opens in a new tab)x_transferred
- https://lists.fedoraproject.org/archives/list/[email protected]/message/QI6RBP6ZKVC2OOCV6SU2FUHPMAXDDJFU/ (opens in a new tab)x_transferred
- https://lists.fedoraproject.org/archives/list/[email protected]/message/JGRJHU2FTSGTHHRTNDF7STEKLKKA25JN/ (opens in a new tab)x_transferred
- https://lists.fedoraproject.org/archives/list/[email protected]/message/LYP3FKDS3KAYMQUZVVL73IUI4CWSKLKP/ (opens in a new tab)x_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2023-35936)Record last updated .