EUVD-2026-57696

PDF::WebKit versions through 1.2 for Perl allow OS command injection via a 2-arg open of the output path in topdf and of stylesheet paths in styletagfor. topdf reads the generated PDF back from its path argument, and styletagfor reads each entry of the stylesheets list, by assigning the path to a...

CVE-2026-17431

PDF::WebKit versions through 1.2 for Perl are vulnerable to OS command injection because the software uses Perl's 2-arg open() to handle output paths and stylesheet entries. Specifically, the to_pdf() function reads the generated PDF from its path argument, and _style_tag_for() reads stylesheet e...

CVE-2026-17431 PDF::WebKit versions through 1.2 for Perl allow OS command injection via a 2-arg open() of the output path in to_pdf and of stylesheet paths in _style_tag_for

PDF::WebKit versions through 1.2 for Perl allow OS command injection via a 2-arg open of the output path in topdf and of stylesheet paths in styletagfor. topdf reads the generated PDF back from its path argument, and styletagfor reads each entry of the stylesheets list, by assigning the path to a...

PT-2026-71366

Name of the Vulnerable Software and Affected Versions PDF::WebKit versions through 1.2 Description OS command injection is possible when untrusted input is passed as the output path or as a stylesheet entry. The issue occurs because the to pdf function reads the generated PDF from its path...

OESA-2026-2789 perl-GD security update

This is a autoloadable interface module for libgd, a popular library for creating and manipulating PNG files. With this library you can create PNG images on the fly or modify existing files. Features include: Security Fixes: GD versions before 2.86 for Perl allow OS command injection and file...

AZL-93024 CVE-2026-8450 affecting package perl-HTTP-Daemon for versions less than 6.16-2

HTTP::Daemon versions before 6.17 for Perl allow OS command injection via sendfile. sendfile opens its string argument with Perl's 2-arg open. The 2-arg form interprets magic prefixes: '| cmd' and 'cmd |' open a pipe to a subprocess, ' path' and ' path' open the path for write or append. Untruste...