← Database

CVE-2026-26830

CRITICAL CVSS: 9.8 Published: 2026-03-25 Modified: 2026-06-17

Description

pdf-image (npm package) through version 2.0.0 allows OS command injection via the pdfFilePath parameter. The constructGetInfoCommand and constructConvertCommandForPage functions use util.format() to interpolate user-controlled file paths into shell command strings that are executed via child_process.exec()

Affected Platforms

Pdf-Image Project Pdf-Image

Weakness Type

CWE-94

References