Pdf-image vulnerabilities

1 known vulnerability in Pdf-image from Pdf-image Project. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Pdf-image: Improper Control of Generation of Code

  CVE-2026-26830Mar 25, 2026Pdf-image ProjectEPSS 2.56%

  pdf-image (npm package) through version 2.0.0 allows OS command injection via the pdfFilePath parameter. The constructGetInfoCommand and constructConvertCommandForPage functions use util.format() to interpolate user-controlled file paths into shell command str