Loading vulnerability…
CVE-2025-51591 is a server-side request forgery (SSRF) vulnerability affecting JGM Pandoc v3.6.4. Based on the provided content, the issue can be triggered when Pandoc retrieves and parses untrusted HTML content containing a crafted iframe, causing the application to issue server-side requests to attacker-specified targets. In observed exploitation, attackers used HTML documents with iframes pointing to the AWS Instance Metadata Service (IMDS) endpoint to induce requests from the host running Pandoc. This can expose cloud instance metadata and temporary IAM credentials without requiring direct host access, remote code execution, or path traversal. The content also notes that similar risk may arise when Pandoc is used with external components such as a '--pdf-engine' like wkhtmltopdf, which can expand SSRF exposure depending on deployment.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No valid public exploits. Mallory filtered out 1 candidate as fakes, detection scripts, or README-only repos.
All candidate exploits were filtered out by Mallory's validation.
36 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An SSRF vulnerability in Pandoc exploited in the wild to access AWS IMDS and steal EC2 IAM credentials.
A server-side request forgery (SSRF) vulnerability in the Pandoc Linux utility that allows attackers to target AWS Instance Metadata Service (IMDS) and steal EC2 IAM credentials by submitting malicious HTML documents.
A Server-Side Request Forgery (SSRF) vulnerability in Pandoc (CVE-2025-51591) allows attackers to inject a crafted HTML iframe, enabling access to AWS Instance Metadata Service (IMDS) and theft of EC2 IAM credentials.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.