CVE-2026-26830: PDF-Image Project PDF-Image

Critical severity, CVSS 9.8. EPSS: 3.2% chance of exploitation in the next 30 days.

pdf-image (npm package) through version 2.0.0 allows OS command injection via the pdfFilePath parameter. The constructGetInfoCommand and constructConvertCommandForPage functions use util.format() to interpolate user-controlled file paths into shell command strings that are executed via child_process.exec()

Affected products

• PDF-Image Project PDF-Image: up to and including 2.0.0

Published 2026-03-25. Last modified 2026-06-17.