CVE-2026-110636

pypdftk through 0.5 contains an OS command injection vulnerability in fillform, dumpdatafields, and pdftkcmdutil that builds shell commands from caller-supplied paths. Attackers controlling pdfpath or outfile can inject shell metacharacters interpreted by subprocess.Popen with shell=True to execu...