Is CVE-2026-119343 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-119343 being exploited in the wild.

How severe is CVE-2026-119343?

Medium severity, with a CVSS score of 6.8, published 30 October 2026.

Which products and versions are affected?

Stirling-Tools Stirling-PDF before 3.0.0.

Is there a fix for CVE-2026-119343?

Yes: fixed in 3.0.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-119343 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-119343?

Check whether you run Stirling-Tools Stirling-PDF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-119343: Stirling-PDF unsanitized HTML to PDF conversion in create-pdf-from-html-agent

CVE-2026-119343 · Severity: medium · CVSS 6.8 · Published 2026-10-30

Stirling-PDF is a locally hosted web application for performing operations on PDF files. A vulnerable endpoint accepts user-supplied HTML content and converts it to PDF without proper sanitization, allowing attackers to read local files or make requests to internal systems by embedding file:// and HTTP/HTTPS URLs in the HTML. When login is disabled (a common configuration), this endpoint is accessible without authentication.

Technologies: Stirling-Tools Stirling-PDF. Vendors: Stirling-Tools.

Quick answers

Is CVE-2026-119343 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-119343 being exploited in the wild.
How severe is CVE-2026-119343?: Medium severity, with a CVSS score of 6.8, published 30 October 2026.
Which products and versions are affected?: Stirling-Tools Stirling-PDF before 3.0.0.
Is there a fix for CVE-2026-119343?: Yes: fixed in 3.0.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-119343 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-119343?: Check whether you run Stirling-Tools Stirling-PDF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 3.0.0

Technical details

The POST /api/v1/ai/tools/create-pdf-from-html-agent endpoint passes attacker-controlled htmlContent directly to WeasyPrint without applying the CustomHtmlSanitizer used by the safer /api/v1/convert/html/pdf path. An attacker can embed file:// references to read local files accessible to the Stirling-PDF process, or HTTP/HTTPS resource references to trigger server-side requests to internal services or cloud metadata endpoints. The flaw is reachable without authentication when security.enableLogin is false.

Affected products

Stirling-Tools Stirling-PDF before 3.0.0

Timeline

2026-10-30: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.