CVE-2026-85672

zerox 1.1.20 contains an OS command injection vulnerability in the file download mechanism where the temporary file extension derived from document URLs is interpolated unsanitized into shell commands executed by poppler utilities. Attackers can craft document URLs with malicious file extensions...

CVE-2026-85672

zerox 1.1.20 (getomni-ai) is affected by an OS command injection in its file download mechanism. The temporary file extension derived from document URLs is interpolated unsanitized into shell commands executed by poppler utilities. An attacker can craft a document URL with a malicious file extens...

PT-2026-85565

zerox 1.1.20 contains an OS command injection vulnerability in the file download mechanism where the temporary file extension derived from document URLs is interpolated unsanitized into shell commands executed by poppler utilities. Attackers can craft document URLs with malicious file extensions...

CVE-2026-85672: Improper Neutralization of Special Elements used in an OS Command

zerox 1.1.20 contains an OS command injection vulnerability in the file download mechanism where the temporary file extension derived from document URLs is interpolated unsanitized into shell commands executed by poppler utilities. Attackers can craft document URLs with malicious file extensions...

The vulnerability of the PDF document conversion tool pdftops, which operates in the PostScript format, stems from the handling of the zero pointer. This allows a malicious actor to trigger a service failure.

The vulnerability of the PDF document conversion utility in the pdftops format within the poppler-utils package relates to the handling of the null pointer. Exploiting this vulnerability could allow an attacker to cause a service failure by entering a specially crafted sequence of data in the...