CVE-2026-26830 - Vulnerability Analysis

Overview

pdf-image (npm package) <= 2.0.0 contains a command injection caused by unsafe interpolation of user-controlled pdfFilePath in shell commands, letting attackers execute arbitrary OS commands remotely, exploit requires control over pdfFilePath parameter.

Severity & Score

Impact

Attackers can execute arbitrary OS commands, potentially leading to full system compromise.

Mitigation

Update to a version later than 2.0.0 or apply patches that sanitize input before command execution.

References

• https://github.com/mooz/node-pdf-image
• https://github.com/zebbernCVE/CVE-2026-26830
• https://www.npmjs.com/package/pdf-image

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner