CVE Intelligence

Pdf-image Project vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Pdf-image Project products: 1 record(s), with severity, exploitation and fixes.

Pdf-image 1

Exploited only (KEV) →

CVE-2026-26830 Critical · 9.8 CWE-94 Mar 25, 2026
Code Injection in Pdf-image Project Pdf-image
pdf-image (npm package) through version 2.0.0 allows OS command injection via the pdfFilePath parameter. The constructGetInfoCommand and constructConvertCommandForPage functions use util.format() to interpolate user-controlled file paths into shell command strings that are executed via child_process.exec()