CVE-2026-26830: 
JavaScript vulnerability analysis and mitigation

CVE-2026-26830 is an OS command injection vulnerability in the pdf-image npm package (versions through 2.0.0) that allows unauthenticated remote attackers to execute arbitrary shell commands by supplying a malicious file path via the pdfFilePath parameter. The vulnerability was published on March 25, 2026, and affects all versions of the package up to and including 2.0.0, which receives approximately 10,000 weekly downloads. No fixed version was available as of the disclosure date. It carries a CVSS v3.1 base score of 9.8 (Critical), assigned by MITRE (PoC Advisory, Feedly).

The root cause is improper neutralization of shell metacharacters in user-controlled input, classified as CWE-94 (Improper Control of Generation of Code) and more specifically CWE-78 (OS Command Injection). The vulnerable functions constructGetInfoCommand() and constructConvertCommandForPage() in index.js use util.format() to interpolate the pdfFilePath argument directly into shell command strings, which are then executed via Node.js's child_process.exec() — a function that passes the command string to a system shell, enabling injection of arbitrary shell metacharacters. An attacker who can control the file path passed to PDFImage (e.g., through a web application that accepts user-supplied PDF paths) can inject shell commands such as test.pdf"; touch /tmp/pwned; echo " to achieve arbitrary command execution. No authentication or special privileges are required (PoC Advisory, node-pdf-image).

Successful exploitation grants an unauthenticated remote attacker arbitrary OS command execution with the privileges of the Node.js application process, resulting in full compromise of confidentiality, integrity, and availability. Attackers can read sensitive files, modify or delete data, establish persistent backdoors, or use the compromised server as a pivot point for lateral movement within the network. Given the package's ~10,000 weekly downloads, the attack surface spans any web application or service that passes user-controlled input to the pdf-image library (PoC Advisory, Feedly).

A functional proof-of-concept exploit is publicly available on GitHub, containing runnable JavaScript code that demonstrates OS command injection by passing a malicious file path to PDFImage.getInfo() (PoC Advisory). As of the time of reporting, there is no confirmed evidence of in-the-wild exploitation, and no threat actor attribution has been made. The EPSS score is approximately 0.00354 (low probability of exploitation in the near term), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

1. Reconnaissance: Identify web applications or services that use the pdf-image npm package (versions ≤ 2.0.0) and accept user-supplied file paths for PDF processing. Search npm dependency manifests, GitHub repositories, or use tools like Shodan to find exposed services.
2. Identify injection point: Locate the application endpoint that accepts a PDF file path and passes it to PDFImage constructor or related functions such as getInfo() or convertPage().
3. Craft malicious payload: Construct a file path string containing shell metacharacters to break out of the command context, e.g.:

   test.pdf"; <malicious_command>; echo "

4. Inject payload: Submit the crafted path to the vulnerable application endpoint (e.g., via HTTP request parameter, file upload field, or API call).
5. Trigger execution: The application passes the path to constructGetInfoCommand() or constructConvertCommandForPage(), which uses util.format() to embed it into a shell command string executed by child_process.exec(), causing the injected command to run.
6. Achieve objective: The injected command executes with the privileges of the Node.js process — establish a reverse shell, exfiltrate data, or create persistence (e.g., add SSH keys, install a web shell) (PoC Advisory).

• Process: Unexpected child processes spawned by the Node.js application process (e.g., /bin/sh, bash, curl, wget, python, nc) with unusual arguments or connecting to external IPs.
• File System: Unexpected files created in world-writable directories such as /tmp/ (e.g., /tmp/pwned); new cron jobs, SSH authorized_keys modifications, or web shells added to the application directory.
• Network: Outbound connections from the Node.js server to unknown external IP addresses, particularly on non-standard ports; reverse shell traffic patterns.
• Logs: Application logs showing PDF processing requests with file paths containing shell metacharacters (e.g., ;, |, &, $(, backticks); Node.js error logs referencing unexpected command execution failures in child_process.exec() calls (PoC Advisory).

No patched version of pdf-image was available as of the disclosure date (March 24, 2026); the package's upstream repository (mooz/node-pdf-image) was archived in 2020 and is no longer maintained. Immediate mitigations include: (1) Stop passing untrusted input to PDFImage — validate and allowlist acceptable file paths before use; (2) Replace child_process.exec() with child_process.execFile() or spawn() using argument arrays to prevent shell interpretation; (3) Migrate to a maintained alternative npm package for PDF-to-image conversion; (4) Apply input sanitization to strip or reject shell metacharacters from any user-supplied file paths. Organizations should audit all applications depending on pdf-image ≤ 2.0.0 and prioritize removal or replacement (PoC Advisory, Feedly).

The vulnerability received coverage from The Hacker Wire and Yazoul.net security advisory sites shortly after disclosure (The Hacker Wire, Yazoul Advisory). Community discussion appeared on Reddit's r/pwnhub and on Mastodon/Infosec.exchange, with commentary noting the critical severity and the lack of an available patch given the package's archived status. The abandoned state of the upstream repository was highlighted as a supply chain risk concern, given the package's continued widespread use (~10,000 weekly downloads).