CVE-2026-26830

critical

Description

pdf-image (npm package) through version 2.0.0 allows OS command injection via the pdfFilePath parameter. The constructGetInfoCommand and constructConvertCommandForPage functions use util.format() to interpolate user-controlled file paths into shell command strings that are executed via child_process.exec()

References

https://github.com/zebbernCVE/npm-cve-2026-26830-26833

https://www.npmjs.com/package/pdf-image

https://github.com/zebbernCVE/CVE-2026-26830

https://github.com/mooz/node-pdf-image

Details

Source: Mitre, NVD

Published: 2026-03-25

Updated: 2026-04-02

Risk Information

CVSS v2

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Severity: Critical

CVSS v3

Base Score: 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

EPSS

EPSS: 0.00253