Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

pdfminer-six

2 known vulnerabilities (1 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
20260107.0.0 (Jan 7, 2026): no advisory affects it
Newest unaffected release
20260107.0.0 (Jan 7, 2026), the latest release
Advisories
2 · 1 high, 1 medium
Weekly downloads
16.6M
Dependents
2,275
Releases
37 since 20140915.0.0
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

  • CVE-2025-70559
    Affects 20140915.0.0 to 20251229.0.0 (20251230.0.0 is outside it)
  • CVE-2025-64512
    Affects 20140915.0.0 to 20250506.0.0 (20251107.0.0 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 2

  • CVE-2025-70559Medium 6.5

    pdfminer.six before 20251230 contains an insecure deserialization vulnerability in the CMap loading mechanism.

    Affected: fixed in 20251230.

    Fixed in 20251230.0.0 (released Dec 30, 2025, 35 days before disclosure).

    The latest release, 20260107.0.0, is not affected.

  • pdfminer.six vulnerable to Arbitrary Code Execution via Crafted PDF Input

    Affected: fixed in 20251107.

    Fixed in 20251107.0.0 (released Nov 7, 2025, 3 days before disclosure).

    The latest release, 20260107.0.0, is not affected.