CVE-2026-26830
Published: 25 March 2026
Description
pdf-image (npm package) through version 2.0.0 allows OS command injection via the pdfFilePath parameter. The constructGetInfoCommand and constructConvertCommandForPage functions use util.format() to interpolate user-controlled file paths into shell command strings that are executed via child_process.exec()
Mitigating Controls (NIST 800-53 r5)AI
Directly requires identification, reporting, and correction of the OS command injection flaw in the pdf-image npm package to eliminate the vulnerability.
Mandates validation of user-controlled pdfFilePath inputs to block injection of arbitrary OS commands into shell executions via child_process.exec().
Enables vulnerability scanning to identify the presence of CVE-2026-26830 in npm dependencies like pdf-image for subsequent remediation.
Security SummaryAI
CVE-2026-26830 is an OS command injection vulnerability (CWE-94) in the pdf-image npm package through version 2.0.0. The issue resides in the constructGetInfoCommand and constructConvertCommandForPage functions, which use Node.js util.format() to interpolate user-controlled pdfFilePath parameters into shell command strings subsequently executed via child_process.exec(). It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and was published on 2026-03-25T15:16:38.620.
Attackers can exploit this remotely over the network with low complexity, requiring no privileges, authentication, or user interaction. By supplying a malicious pdfFilePath, an unauthenticated remote attacker can inject arbitrary operating system commands, achieving high-impact confidentiality, integrity, and availability violations, including potential full server compromise.
Mitigation details are available in related advisories and resources, including the project repositories at https://github.com/mooz/node-pdf-image and https://github.com/zebbernCVE/CVE-2026-26830, as well as the npm package page at https://www.npmjs.com/package/pdf-image.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables remote exploitation of public-facing Node.js applications (T1190) via command injection, directly facilitating arbitrary OS command execution through shell interpreter (T1059.004).