by Kastro
Paper/Archive/CVE-2026-26830

CVE-2026-26830

mitre — pdf-image (npm package) through version 2.0.0 allows OS command injection via the pdfFilePath parameter.

EPSS 3%public exploitCVSS 9.8
critical.is priorityof 100
56
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 84.7.847 × 2016.9Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

pdf-image (npm package) through version 2.0.0 allows OS command injection via the pdfFilePath parameter. The constructGetInfoCommand and constructConvertCommandForPage functions use util.format() to interpolate user-controlled file paths into shell command strings that are executed via child_process.exec()

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

mitre (CNA)9.8CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refnpmjs.com/package/pdf-imagerefgithub.com/mooz/node-pdf-imagerefgithub.com/zebbernCVE/CVE-2026-26830