~ / search / GHSA-q5mh-72xg-628w

GHSA-q5mh-72xg-628w

pdf-image has an OS Command Injection Vulnerability through its pdfFilePath parameter

Source: GitHub Advisory Database (reviewed) Critical CVE-2026-26830

Packages

EcosystemPackageAffectedFixed in
npm pdf-image <= 2.0.0 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

pdf-image (npm package) through version 2.0.0 allows OS command injection via the pdfFilePath parameter. The constructGetInfoCommand and constructConvertCommandForPage functions use util.format() to interpolate user-controlled file paths into shell command strings that are executed via child_process.exec().

References

External links from the advisory. They lead to third-party sites.