CVE-2022-25765

Command Injection

7.3 HighPublic exploitFix available

The package pdfkit from 0.0.0 are vulnerable to Command Injection where the URL is not properly sanitized.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: Low

Exploit likelihood

42.5%Up 41.5 points since Sep 9, 2022

What each source reports

CVE List Score used 7.3

Command Injection

The package pdfkit from 0.0.0 are vulnerable to Command Injection where the URL is not properly sanitized.

Record: CVE-2022-25765
CVSS 3.1: 7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P
Updated: 2026-11-02

EUVDEUVD-2022-6937 7.3

The package pdfkit from 0.0.0 are vulnerable to Command Injection where the URL is not properly sanitized.

Record: EUVD-2022-6937
CVSS 3.1: 7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P
Updated: 2026-11-03

GitHub AdvisoriesGHSA-rhwx-hjx2-x4qr 9.8

PDFKit vulnerable to Command Injection

The package pdfkit is vulnerable to Command Injection where the URL is not properly sanitized.

Note: This issue was patched in 0.8.7.2, but the patch was discovered to be ineffective. The updated patch version is 0.8.7.2.

Record: GHSA-rhwx-hjx2-x4qr
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-77
Updated: 2026-11-02

NVD 7.3

The package pdfkit from 0.0.0 are vulnerable to Command Injection where the URL is not properly sanitized.

Record: CVE-2022-25765
CVSS 3.1: 7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVGHSA-rhwx-hjx2-x4qr 9.8

PDFKit vulnerable to Command Injection

The package pdfkit is vulnerable to Command Injection where the URL is not properly sanitized.

Note: This issue was patched in 0.8.7.2, but the patch was discovered to be ineffective. The updated patch version is 0.8.7.2.

Record: GHSA-rhwx-hjx2-x4qr
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-77
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`pdfkit` RubyGems	before 0.8.7.2	0.8.7.2
`pdfkit` RubyGems	before 0.8.7.2, plus listed versions 0.1.00.1.10.2.00.2.10.2.2 Show 33 moreShow less 0.2.30.3.00.3.10.3.20.3.30.4.00.4.10.4.20.4.30.4.40.4.50.4.60.5.00.5.10.5.20.5.30.5.40.6.10.6.20.7.00.8.00.8.10.8.20.8.30.8.40.8.4.10.8.4.20.8.4.3.10.8.4.3.20.8.50.8.60.8.70.8.7.1	0.8.7.2

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	Jeanback1/CVE-2022-25765-exploit	2026-05-31
PoC in GitHub	LordRNA/CVE-2022-25765	2022-12-11
PoC in GitHub	PurpleWaveIO/CVE-2022-25765-pdfkit-Exploit-Reverse-Shell	2022-12-04
PoC in GitHub	UNICORDev/exploit-CVE-2022-25765	2023-02-10
PoC in GitHub	Wai-Yan-Kyaw/PDFKitExploit	2022-12-07
PoC in GitHub	innocentx0/CVE-2022-25765	2026-09-02
PoC in GitHub	lekosbelas/PDFkit-CMD-Injection	2023-02-21
PoC in GitHub	lowercasenumbers/CVE-2022-25765	2024-01-22
PoC in GitHub	nikn0laty/PDFkit-CMD-Injection-CVE-2022-25765	2023-01-29
PoC in GitHub	shamo0/PDFkit-CMD-Injection	2022-12-20

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-25765 is a high vulnerability (CVSS 7.3) in Pdfkit Project Pdfkit, published September 9, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 42.5%, the 98th percentile. Fixed in pdfkit 0.8.7.2.

References

Show 12 moreShow less