2 matches found
CVE-2026-26830: Improper Control of Generation of Code
pdf-image npm package through version 2.0.0 allows OS command injection via the pdfFilePath parameter. The constructGetInfoCommand and constructConvertCommandForPage functions use util.format to interpolate user-controlled file paths into shell command strings that are executed via childprocess.e...
9.8CVSS6AI score0.02505EPSS
SaveExploits4References1
CVE-2026-26830
pdf-image npm package through version 2.0.0 allows OS command injection via the pdfFilePath parameter. The constructGetInfoCommand and constructConvertCommandForPage functions use util.format to interpolate user-controlled file paths into shell command strings that are executed via childprocess.e...
9.8CVSS6AI score0.02505EPSS
SaveExploits4References4
20