CVE-2021-43113: Debian Linux

Critical severity, CVSS 9.8. EPSS: 5.4% chance of exploitation in the next 30 days.

iTextPDF in iText 7 and up to (excluding 4.4.13.3) 7.1.17 allows command injection via a CompareTool filename that is mishandled on the gs (aka Ghostscript) command line in GhostscriptHelper.java.

Affected products

• Debian Debian Linux: version 10.0 only; version 11.0 only
• Itextpdf Itext: from 7.0.0, before 7.1.17 (fixed in 7.1.17)

Published 2021-12-15. Last modified 2026-06-17.