Although pandoc itself will not create or modify any files other than those you explicitly ask it create (with the exception of temporary files used in producing PDFs), a filter or custom writer could in principle do anything on your file system. Please audit filters and custom writers very carefully before using them.
If you want to use pandoc in a web application that accepts untrusted user input, you should be aware that running pandoc in this context requires special precautions, or you risk exfiltration of the contents of local files, or worse. In particular:
Several input formats (including LaTeX, Org, RST, and Typst)
support include directives that allow the contents of a
file to be included in the output. An untrusted attacker could use these
to view the contents of files on the file system. Using the
--sandbox option will protect against this threat.
Several output formats (including RTF, FB2, HTML with
--self-contained, EPUB, Docx, and ODT) will embed encoded
or raw images into the output file. An untrusted attacker could exploit
this to view the contents of non-image files on the file system. Using
the --sandbox option will protect against this threat, but
will also prevent including images in these formats.
In reading HTML files, pandoc will attempt to include the
contents of iframe elements by fetching content from the
local file or URL specified by src. If untrusted HTML is
processed on a server, this has the potential to reveal anything
readable by the process running the server or to enable server-side
request forgery (SSRF) attacks (CVE-2025-51591).
To mitigate such attacks, use --sandbox or
-f html+raw_html (which causes the whole
iframe to be parsed as a raw HTML block).
Using pandoc with --pdf-engine introduces additional
risks, which cannot be mitigated by using --sandbox. For
example, in wkhtmltopdf the footer-html and
header-html metadata fields will be passed directly to
wkhtmltopdf as --footer-html and
--header-html arguments, and by using a file:
URIs with these, one could exfiltrate local files. In addition, using
--pdf-engine=wkhtmltopdf with -f html+raw_html
enables an SSRF vulnerability in wkhtmltopdf (CVE-2022-35583).
Note that [wkhtmltopdf) is deprecated and its
authors recommend not to use it with any untrusted input. However, there
may be similar issues with other pdf-engines. Anyone including a
pdf-engine in a pandoc command run on untrusted input should audit the
engine carefully and carefully control the use of
--pdf-engine-opt.
Here are some alternatives for safe use of pandoc in a web application:
Use pandoc server to spin up a local web server, and
have your application make requests to it. The server runs in sandboxed
mode and will not be able to read files or use filters.
Use the WASM version of pandoc. This allows the use of Lua filters, but everything runs in an isolated WASM sandbox.
Use pandoc --sandbox. However, be aware that the
sandbox function only affects readers and writers, and security issues
can arise if you use it together with --filter or
--pdf-engine.
The HTML generated by pandoc is not guaranteed to be safe. If
raw_html is enabled for the Markdown input, users can
inject arbitrary HTML. Even if raw_html is disabled, users
can include dangerous content in URLs and attributes. To be safe, you
should run all HTML generated from untrusted user input through an HTML
sanitizer.
Pandoc’s parsers can exhibit pathological performance on some
corner cases. It is wise to put any pandoc operations under a timeout,
to avoid DOS attacks that exploit these issues. If you are using the
pandoc executable, you can add the command line options
+RTS -M512M -RTS (for example) to limit the heap size to
512MB. Note that the commonmark parser (including
commonmark_x and gfm) is much less vulnerable
to pathological performance than the markdown parser, so it
is a better choice when processing untrusted input.
If your application uses pandoc as a Haskell library (rather than
shelling out to the executable), it is possible to use it in a mode that
fully isolates pandoc from your file system, by running the pandoc
operations in the PandocPure monad. See the document Using the pandoc
API for more details. (This corresponds to the use of the
--sandbox option on the command line.)