Command Injection in pdf-image

CRITICO 9.8CVE-2018-3757 · GHSA-5gwh-g79j-vh4q · Published 01/06/2018 · updated 17/06/2026

In breve

CVE-2018-3757 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda pdf-image (pdf-image project), pdf-image.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 4.6%, superiore al 91.7% delle vulnerabilità.
Correzione: aggiornare a 2.0.0 o successiva.

Package	Affected versions	Patched versions
pdf-image pdf-image_project	`= 2.0.0`	No fix yet
pdf-image npm	`< 2.0.0`	`2.0.0`

Description

Versions of pdf-image before 2.0.0 are vulnerable to command injection. This vulnerability is exploitable if the attacker has control over the pdfFilePath variable passed into pdf-image.

Recommendation

Update to version 2.0.0 or later.

NVD description

Command injection exists in pdf-image v2.0.0 due to an unescaped string parameter.

References

nvd.nist.gov/vuln/detail/CVE-2018-3757 · ADVISORY
roest01/node-pdf-image commit 5467949 · WEB
hackerone.com/reports/340208 · WEB
roest01/node-pdf-image · PACKAGE
npmjs.com/advisories/670 · WEB

Altre vulnerabilità di pdf-image

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free