CVE-2026-26830 - Vulnerability Analysis

Overview

pdf-image (npm package) <= 2.0.0 contains a command injection caused by unsafe interpolation of user-controlled pdfFilePath in shell commands, letting attackers execute arbitrary OS commands remotely, exploit requires control over pdfFilePath parameter.

Severity & Score

Impact

Attackers can execute arbitrary OS commands, potentially leading to full system compromise.

Mitigation

Update to a version later than 2.0.0 or apply patches that sanitize input before command execution.

References

• https://github.com/mooz/node-pdf-image
• https://github.com/zebbernCVE/CVE-2026-26830
• https://www.npmjs.com/package/pdf-image

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 25, 2026

🔴 CVE-2026-26830 - Critical (9.8) pdf-image (npm package) through version 2.0.0 allows OS command injection via the pdfFilePath parameter. The constructGetInfoCommand and constructConvertCommandForPage functions use util.format() to interpolate user-controlled file paths into shel... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-26830/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

GitHub Repositories(2 repos)

• https://github.com/zebbernCVE/npm-cve-2026-26830-26833
• https://github.com/zebbernCVE/CVE-2026-26830

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner