CVE-2022-25765
Command Injection
CRITICAL 9.8EPSS 41.6%
The package pdfkit from 0.0.0 are vulnerable to Command Injection where the URL is not properly sanitized.
- Affected
- pdfkit
- CVSS v3.1 NVD
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS v3.1 SNYK
- 7.3 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - EPSS
- 41.57% chance of exploitation in the next 30 days, 99th percentile
- Published
- 2022-09-09
- Updated
- 2024-09-16
Proof-of-concept exploits (13)
- https://security.snyk.io/vuln/SNYK-RUBY-PDFKIT-2869795
- CyberArchitect1/CVE-2022-25765-pdfkit-Exploit-Reverse-Shell20★ · 2022-12-06
- LordRNA/CVE-2022-257653★ · 2022-12-11
- PurpleWaveIO/CVE-2022-25765-pdfkit-Exploit-Reverse-Shell20★ · 2022-12-06
- UNICORDev/exploit-CVE-2022-2576531★ · 2025-09-12
- Wai-Yan-Kyaw/PDFKitExploit0★ · 2022-11-29
- bmshema/CVE_PoCs1★ · 2023-09-18
- lekosbelas/PDFkit-CMD-Injection0★ · 2023-02-22
- lowercasenumbers/CVE-2022-257650★ · 2025-11-19
- nikn0laty/PDFkit-CMD-Injection-CVE-2022-2576510★ · 2023-01-29
- shamo0/PDFkit-CMD-Injection16★ · 2022-12-21
- Jeanback1/CVE-2022-25765-exploit0★ · 2026-05-31
- innocentx0/CVE-2022-257650★ · 2026-09-02