Command Injection in pdf-image

CRÍTICO 9.8CVE-2018-3757 · GHSA-5gwh-g79j-vh4q · Published 01/06/2018 · updated 17/06/2026

En resumen

CVE-2018-3757 es una vulnerabilidad CRÍTICO (CVSS 9.8) que afecta a pdf-image (pdf-image project), pdf-image.
Probabilidad de explotación en los próximos 30 días (EPSS): 4.6%, mayor que el 91.7% de las vulnerabilidades.
Solución: actualizar a 2.0.0 o posterior.

Package	Affected versions	Patched versions
pdf-image pdf-image_project	`= 2.0.0`	No fix yet
pdf-image npm	`< 2.0.0`	`2.0.0`

Description

Versions of pdf-image before 2.0.0 are vulnerable to command injection. This vulnerability is exploitable if the attacker has control over the pdfFilePath variable passed into pdf-image.

Recommendation

Update to version 2.0.0 or later.

NVD description

Command injection exists in pdf-image v2.0.0 due to an unescaped string parameter.

References

nvd.nist.gov/vuln/detail/CVE-2018-3757 · ADVISORY
roest01/node-pdf-image commit 5467949 · WEB
hackerone.com/reports/340208 · WEB
roest01/node-pdf-image · PACKAGE
npmjs.com/advisories/670 · WEB

Más vulnerabilidades de pdf-image

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free