CVE-2026-26830: OS command injection in pdf-image

Summary

pdf-image through version 2.0.0 allows OS command injection via the pdfFilePath argument. The package builds shell command strings with util.format() and executes them with child_process.exec(). If an application passes an attacker-controlled file path into PDFImage, shell metacharacters in that path can lead to arbitrary command execution.

Affected product

Vulnerability details

• CVE ID: CVE-2026-26830
• CWE: CWE-78 - OS Command Injection
• CVSS 3.1: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Affected component: index.js

The vulnerable code path reaches constructGetInfoCommand() and constructConvertCommandForPage(), both of which interpolate the PDF path into a shell command before calling child_process.exec().

Technical impact

Any application that accepts a user-controlled PDF path and passes it to pdf-image can end up executing attacker-supplied shell commands on the host system.

Proof of concept

const { PDFImage } = require("pdf-image");

const pdfImage = new PDFImage('test.pdf"; touch /tmp/pwned; echo "');
pdfImage.getInfo();

If the injected command runs, the process creates /tmp/pwned.

Mitigation

No fixed npm release is available at the time of writing.

If you still depend on this package:

1. Stop passing untrusted file paths into PDFImage.
2. Replace shell-string construction with argument-safe process execution such as execFile() or spawn() with an array.
3. Prefer a maintained alternative or a private fork with a fix.

References

• https://www.npmjs.com/package/pdf-image
• https://github.com/mooz/node-pdf-image
• https://github.com/mooz/node-pdf-image/blob/master/index.js