fix(deps): require pdfminer-six >=20251107 for VULN-92490 - #153
Open
shuningc wants to merge 1 commit into
Open
Conversation
shuningc
marked this pull request as ready for review
July 27, 2026 21:39
shuningc
requested review from
adityamehra,
etserend,
fercor-cisco,
keith-decker,
pradystar and
ridhima-splunk
July 28, 2026 20:57
fercor-cisco
left a comment
fercor-cisco
left a comment
Collaborator
There was a problem hiding this comment.
🤖 This review was generated by the Astra agent (claude-opus-4-8). It may contain mistakes.
Verdict: needs_discussion — The fix correctly raises pdfminer.six to a safe version, but converts it (and cryptography) from optional to mandatory for all installs, which needs a design decision.
fercor-cisco
requested changes
Jul 30, 2026
fercor-cisco
left a comment
fercor-cisco
left a comment
Collaborator
There was a problem hiding this comment.
this dependency should not be mandatory
shuningc
force-pushed
the
VULN-92490-pdfminer-six-upgrade
branch
from
July 30, 2026 18:21
8fa3960 to
a2f5645
Compare
Add a direct pdfminer-six floor in pyproject.toml and regenerate poetry.lock so transitive usage resolves to 20260107 (fixed release). Fixes unsafe pickle.loads() in CMapDB._load_data() via malicious PDF CMap paths. Co-authored-by: Cursor <cursoragent@cursor.com>
shuningc
force-pushed
the
VULN-92490-pdfminer-six-upgrade
branch
from
July 30, 2026 18:40
a2f5645 to
bda20c4
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes VULN-92490 by upgrading
pdfminer-sixto>=20251107.Prior to 20251107,
CMapDB._load_data()in pdfminer.six usespickle.loads()to deserialize CMap pickle files. A malicious PDF can specify an alternative directory and filename ending in.pickle.gz, causing arbitrary code execution when the PDF is processed.Changes
pdfminer-six = ">=20251107"direct dependency floor inpyproject.toml(matches idna/filelock/requests vuln-fix pattern)poetry.lock(resolves20260107, up from transitive20250506)pdfplumberalso bumps to0.11.10via lock resolutionrequirements.txtpins needed (pdfminer.six not pinned in examples)Vulnerability
Test plan
poetry lockvalidates