CVE-2023-26155: 
JavaScript vulnerability analysis and mitigation

The node-qpdf package contains a Command Injection vulnerability (CVE-2023-26155) that affects all versions of the package. The vulnerability was discovered on February 20, 2023, and publicly disclosed on June 30, 2023. The issue exists in the package-exported encrypt() method, which fails to properly sanitize parameter input that flows into a command execution API (Snyk Advisory).

The vulnerability is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command) and has received a CVSS v3.1 base score of 9.8 (CRITICAL) from NIST NVD and 7.3 (HIGH) from Snyk. The vulnerability allows attackers to inject malicious commands when they can specify the input PDF file path. The attack vector is network-based with low attack complexity, requiring no privileges or user interaction (NVD).

When exploited, this vulnerability can lead to command injection attacks, potentially allowing attackers to execute arbitrary commands on the affected system. The impact includes potential loss of confidentiality, integrity, and availability of the system, though the attacker's control over the extent of modifications may be limited (Snyk Advisory).

Currently, there is no fixed version available for the node-qpdf package (Snyk Advisory).