pdf-image has an OS Command Injection Vulnerability through its pdfFilePath parameter

CRITICAL 9.8CVE-2026-26830 · GHSA-q5mh-72xg-628w · Published 25/03/2026 · updated 17/06/2026

Package	Affected versions	Patched versions
pdf-image pdf-image_project	`≤ 2.0.0`	No fix yet
pdf-image npm	`≤ 2.0.0`	No fix yet

Description

pdf-image (npm package) through version 2.0.0 allows OS command injection via the pdfFilePath parameter. The constructGetInfoCommand and constructConvertCommandForPage functions use util.format() to interpolate user-controlled file paths into shell command strings that are executed via child_process.exec().

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2026-26830 · ADVISORY
mooz/node-pdf-image · PACKAGE
zebbernCVE/CVE-2026-26830 · WEB
npmjs.com/package/pdf-image · Product

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free