CVE-2016-4991
CRITICALnodepdf 1.3.0 - Command Injection via Improper Shell Escape
Title source: llmDescription
Input passed to the Pdf() function is shell escaped and passed to child_process.exec() during PDF rendering. However, the shell escape does not properly encode all special characters, namely, semicolon and curly braces. This can be abused to achieve command execution. This problem affects nodepdf 1.3.0.
References (1)
Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://lf.lc/cve/cve-2016-4991/
Scores
CVSS v3
9.8
EPSS
0.0142
EPSS Percentile
69.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-77
Status
published
Products (1)
nodepdf_project/nodepdf
1.3.0
Published
Jul 28, 2022
Tracked Since
Feb 18, 2026