HSEC-2023-0014
NoneCVSS
—
EPSS
—
Published
Nov 14, 2025
CISA due date
—
The record
Arbitrary file write is possible when using PDF output or --extract-media with untrusted input
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | pandoc | 0 | 2.9.2.1-1+deb11u1 |
| Debian:12 | pandoc | 0 | 2.17.1.1-2~deb12u1 |
| Debian:13 | haskell-pandoc | 0 | 3.0.1-2 |
| Debian:13 | pandoc | 0 | 2.17.1.1-2 |
| Hackage | pandoc | 1.13 | 3.1.4 |
| Ubuntu:20.04:LTS | pandoc | 0 | No fix |
| Ubuntu:22.04:LTS | pandoc | 0 | No fix |
| Ubuntu:24.04:LTS | pandoc | 0 | No fix |
| Ubuntu:Pro:14.04:LTS | pandoc | 0 | No fix |
| Ubuntu:Pro:16.04:LTS | pandoc | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | pandoc | 0 | No fix |