CVE-2026-110642 xhtml2pdf before 0.2.19 OS Command Injection via startViewer File Name

xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer that allows attackers to execute commands by interpolating unescaped file names into os.system. Attackers can supply an input file whose name contains a double quote and shell metacharacters, which runs OS...

CVE-2026-110642 xhtml2pdf before 0.2.19 OS Command Injection via startViewer File Name

xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer that allows attackers to execute commands by interpolating unescaped file names into os.system. Attackers can supply an input file whose name contains a double quote and shell metacharacters, which runs OS...

CVE-2026-110642

xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer that allows attackers to execute commands by interpolating unescaped file names into os.system. Attackers can supply an input file whose name contains a double quote and shell metacharacters, which runs OS...

EUVD-2026-101270

xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer that allows attackers to execute commands by interpolating unescaped file names into os.system. Attackers can supply an input file whose name contains a double quote and shell metacharacters, which runs OS...

CVE-2026-110642

The xhtml2pdf library before version 0.2.19 contains an OS command injection vulnerability in the pisa.startViewer() function. The root cause is the interpolation of unescaped file names into os.system. An attacker can execute arbitrary commands as the invoking user by providing an input file nam...

CVE-2026-110642

xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer that allows attackers to execute commands by interpolating unescaped file names into os.system. Attackers can supply an input file whose name contains a double quote and shell metacharacters, which runs OS...

CVE-2026-110641 @runnerty/executor-decompress through 3.1.1 OS Command Injection via Archive File Name

@runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted archive file names to compressfile. Attackers who can name a file dropped into a watched directory can inject $ substitutions or unquoted shell...

EUVD-2026-101269

@runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted archive file names to compressfile. Attackers who can name a file dropped into a watched directory can inject $ substitutions or unquoted shell...

EUVD-2026-101268

Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.language values to whisper. Attackers can inject shell metacharacters or $ substitution into the command string built by...

CVE-2026-110641

@runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted archive file names to compressfile. Attackers who can name a file dropped into a watched directory can inject $ substitutions or unquoted shell...

CVE-2026-110640

The whisper-node library (through version 1.1.1 ) is vulnerable to an OS command injection vulnerability in the whisper() function. The root cause is the improper neutralization of special elements within the command string built by createCppCommand() . Attackers can provide crafted filePath or w...

CVE-2026-110640 Whisper-node through 1.1.1 OS Command Injection via filePath and language

Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.language values to whisper. Attackers can inject shell metacharacters or $ substitution into the command string built by...

CVE-2026-110640

Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.language values to whisper. Attackers can inject shell metacharacters or $ substitution into the command string built by...

CVE-2026-110641

The @runnerty/executor-decompress package (versions through 3.1.1 ) is vulnerable to an OS command injection via the compress_file function. The root cause is the improper handling of archive file names, which allows an attacker to inject $() substitutions or unquoted shell metacharacters into sh...

CVE-2026-110640 Whisper-node through 1.1.1 OS Command Injection via filePath and language

Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.language values to whisper. Attackers can inject shell metacharacters or $ substitution into the command string built by...

CVE-2026-110641 @runnerty/executor-decompress through 3.1.1 OS Command Injection via Archive File Name

@runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted archive file names to compressfile. Attackers who can name a file dropped into a watched directory can inject $ substitutions or unquoted shell...

CVE-2026-110639 @mborne/extract before 0.2.1 OS Command Injection via archivePath and targetDir

@mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archivePath or targetDir options. Attackers controlling these values passed to extract can inject commands into unquoted shelljs exec strings ...

EUVD-2026-101267

@mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archivePath or targetDir options. Attackers controlling these values passed to extract can inject commands into unquoted shelljs exec strings ...

CVE-2026-110639 @mborne/extract before 0.2.1 OS Command Injection via archivePath and targetDir

@mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archivePath or targetDir options. Attackers controlling these values passed to extract can inject commands into unquoted shelljs exec strings ...

CVE-2026-110639

@mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archivePath or targetDir options. Attackers controlling these values passed to extract can inject commands into unquoted shelljs exec strings ...