CVE-2026-26830: pdf-image has an OS Command Injection Vulnerability through its pdfFilePath parameter
pdf-image (npm package) through version 2.0.0 allows OS command injection via the pdfFilePath parameter. The constructGetInfoCommand and constructConvertCommandForPage functions use util.format() to interpolate user-controlled file paths into shell command strings that are executed via childprocess.exec().
Published Mar 25, 2026 · Updated Mar 27, 2026
Affected packages
pdf-image
- Ecosystem
- npm
- Affected
- <= 2.0.0
- Fixed in
- No patched version yet
- Check
npm ls pdf-image
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
pdf-image (npm package) through version 2.0.0 allows OS command injection via the pdfFilePath parameter. The constructGetInfoCommand and constructConvertCommandForPage functions use util.format() to interpolate user-controlled file paths into shell command strings that are executed via child_process.exec().
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology