GitHub Advisoryadvisory · npm

GHSA-fpr8-4wvx-j9q3 node-qpdf vulnerable to command injection

HIGH Published 2023-10-14 Modified 2023-10-17 Official page ↗
Aliases
CVE-2023-26155
Ecosystem
npm
Packages
node-qpdf
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-77, CWE-94
Reviewed
2023-10-17

Affected packages

• npm node-qpdf: <= 1.0.3 (no fix yet)

Description

All versions of the package node-qpdf are vulnerable to Command Injection such that the package-exported method encrypt() fails to sanitize its parameter input, which later flows into a sensitive command execution API. As a result, attackers may inject malicious commands once they can specify the input pdf file path.

Related

Alias · CVE (1)

  • CVE-2023-26155 All versions of the package node-qpdf are vulnerable to Command Injection such that the package-exported method encrypt() fails to sanitize… vulnerability

Weakness · CWE (2)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness
  • CWE-94 Improper Control of Generation of Code weakness

References