PT-2026-27783 · Npm · Pdf-Image

Published 2026-03-25 · Updated 2026-03-25 · CVE-2026-26830

Positive Technologies · (AI Summary)

CVSS v3.1

9.8

Critical

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pdf-image versions through 2.0.0

Description The pdf-image npm package is susceptible to a critical OS command injection issue. The pdfFilePath parameter allows for the injection of arbitrary commands through the constructGetInfoCommand and constructConvertCommandForPage functions. These functions utilize util.format() to incorporate user-supplied file paths into shell commands, which are then executed using child process.exec(). This allows an attacker to execute system commands on the underlying operating system.

Recommendations Versions prior to 2.0.1 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2026-26830

Affected Products

Pdf-Image

References · 7

• 🔥 https://github.com/zebbernCVE/CVE-2026-26830 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-26830 · Security Note
• https://github.com/mooz/node-pdf-image · Note
• https://npmjs.com/package/pdf-image · Note
• https://twitter.com/0dayPublishing/status/2036826528898580568 · Twitter Post
• https://reddit.com/r/pwnhub/comments/1s3egl5/critical_os_command_injection_flaw_found_in · Reddit Post
• https://twitter.com/CveFindCom/status/2036846319680069891 · Twitter Post