CVE-2026-26830

CVE-2026-26830: pdf-image における OS コマンドインジェクション 概要 pdf-image のバージョン 2.0.0 までには、pdfFilePath 引数を介した OS コマンドインジェクションの脆弱性があります。このパッケージは util.format でシェルコマンド文字列を構築し、childprocess.exec で実行します。アプリケーションが攻撃者によって制御されたファイルパスを PDFImage に渡すと、そのパスに含まれるシェルのメタ文字によって任意のコマンドが実行される可能性があります。 影響を受ける製品 製品| 影響を受けるバージョン|...

node-vulnerable

node-vulnerable このリポジトリは、Endor Labs EXPOSURE 向けの合成デモターゲット です。 現在の状態は意図的に悪用可能 です。EXPOSURE はこれに対して 悪用可能な判定を報告します。 追跡対象の CVE: CVE-2018-21268 — host 引数による traceroute コマンドインジェクション。このベースラインでは悪用可能 （入力検証なし）。上流の修正はありません。 CVE-2018-3757 — ファイルパス引数による pdf-image コマンドインジェクション。このベースラインでは悪用不可能 （/render ルートが...

CVE-2026-91810 Foxit PDF Editor/Reader Doc Object Out-Of-Bounds Read Information Disclosure Vulnerability

A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF image masks. Inconsistent image metadata may cause incorrect alpha-channel processing during rendering, resulting in an out-of-bounds read and application crash...

CVE-2026-91810 Foxit PDF Editor/Reader Doc Object Out-Of-Bounds Read Information Disclosure Vulnerability

A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF image masks. Inconsistent image metadata may cause incorrect alpha-channel processing during rendering, resulting in an out-of-bounds read and application crash...

EUVD-2026-85164

A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF image masks. Inconsistent image metadata may cause incorrect alpha-channel processing during rendering, resulting in an out-of-bounds read and application crash...

CVE-2026-91810: Out-of-bounds Read

A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF image masks. Inconsistent image metadata may cause incorrect alpha-channel processing during rendering, resulting in an out-of-bounds read and application crash...

PT-2026-97227

Name of the Vulnerable Software and Affected Versions Foxit PDF Editor Reader affected versions not specified Description A heap-based out-of-bounds read occurs during the handling of PDF image objects with inconsistent compression metadata. Insufficient validation during image decoding can lead ...

PT-2026-97229

Name of the Vulnerable Software and Affected Versions Foxit PDF Editor/Reader affected versions not specified Description A heap-based out-of-bounds read occurs during the handling of malformed PDF image masks. Inconsistent image metadata can lead to incorrect alpha-channel processing during...

Exploit for Injection in Traceroute_Project Traceroute

node-vulnerable This repository is a synthetic demo target...

📄 pdf-image 2.0.0 Command Injection

In pdf-image version 2.0.0, a security issue allows OS command injection when untrusted input is passed to the PDFImage constructor and later processed by methods such as getInfo...

DEBIAN-CVE-2026-3308

An integer overflow vulnerability in 'pdf-image.c' in Artifex's MuPDF version 1.27.0 allows an attacker to maliciously craft a PDF that can trigger an integer overflow within the 'pdfloadimageimp' function. This allows a heap out-of-bounds write that could be exploited for arbitrary code executio...

CVE-2026-3308

An integer overflow vulnerability in 'pdf-image.c' in Artifex's MuPDF version 1.27.0 allows an attacker to maliciously craft a PDF that can trigger an integer overflow within the 'pdfloadimageimp' function. This allows a heap out-of-bounds write that could be exploited for arbitrary code executio...

📄 pdf-image 2.0.0 Command Injection

pdf-image through version 2.0.0 allows OS command injection via the pdfFilePath argument. The package builds shell command strings with util.format and executes them with childprocess.exec. If an application passes an attacker-controlled file path into PDFImage, shell metacharacters in that path...

EUVD-2026-15457

pdf-image npm package through version 2.0.0 allows OS command injection via the pdfFilePath parameter. The constructGetInfoCommand and constructConvertCommandForPage functions use util.format to interpolate user-controlled file paths into shell command strings that are executed via childprocess.e...

GHSA-Q5MH-72XG-628W pdf-image has an OS Command Injection Vulnerability through its pdfFilePath parameter

pdf-image npm package through version 2.0.0 allows OS command injection via the pdfFilePath parameter. The constructGetInfoCommand and constructConvertCommandForPage functions use util.format to interpolate user-controlled file paths into shell command strings that are executed via...

pdf-image has an OS Command Injection Vulnerability through its pdfFilePath parameter

pdf-image npm package through version 2.0.0 allows OS command injection via the pdfFilePath parameter. The constructGetInfoCommand and constructConvertCommandForPage functions use util.format to interpolate user-controlled file paths into shell command strings that are executed via...

CVE-2026-26830

pdf-image npm package through version 2.0.0 allows OS command injection via the pdfFilePath parameter. The constructGetInfoCommand and constructConvertCommandForPage functions use util.format to interpolate user-controlled file paths into shell command strings that are executed via childprocess.e...

pdf-image 安全漏洞

pdf-image is a Node.js tool developed by Masafumi Oyamada for converting PDFs to PNG images. Versions of pdf-image 2.0.0 and earlier contain security vulnerabilities. These vulnerabilities stem from the fact that the pdfFilePath parameter is not verified, which may lead to OS command injection...

CVE-2026-26830

pdf-image npm package through version 2.0.0 allows OS command injection via the pdfFilePath parameter. The constructGetInfoCommand and constructConvertCommandForPage functions use util.format to interpolate user-controlled file paths into shell command strings that are executed via childprocess.e...

CVE-2026-26830

pdf-image npm package through version 2.0.0 allows OS command injection via the pdfFilePath parameter. The constructGetInfoCommand and constructConvertCommandForPage functions use util.format to interpolate user-controlled file paths into shell command strings that are executed via childprocess.e...