All versions of the package node-qpdf are vulnerable to Command...
Vulnerability Description
All versions of the package node-qpdf are vulnerable to Command Injection such that the package-exported method encrypt() fails to sanitize its parameter input, which later flows into a sensitive command execution API. As a result, attackers may inject malicious commands once they can specify the input pdf file path.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-26155
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Xiao Feng
