
Directory page for CVE-2026-26830 through CVE-2026-26833 advisories
This repository is only a directory page for four public advisory repositories covering command injection vulnerabilities in npm packages assigned CVE IDs by MITRE on 2026-02-25.
As of 2026-03-24, the latest npm release for each package is still affected:
| CVE | Package | Latest npm release | Status |
|---|---|---|---|
| CVE-2026-26830 | pdf-image | 2.0.0 | affected, no fixed release published |
| CVE-2026-26831 | textract | 2.5.0 | affected, no fixed release published |
| CVE-2026-26832 | node-tesseract-ocr | 2.2.1 | affected, no fixed release published |
| CVE-2026-26833 | thumbler | 1.1.2 | affected, no fixed release published |
https://github.com/zebbernCVE/CVE-2026-26830https://github.com/zebbernCVE/CVE-2026-26831https://github.com/zebbernCVE/CVE-2026-26832https://github.com/zebbernCVE/CVE-2026-26833