Shell command injection in Catalyst::View::Wkhtmltopdf (CVE-2026-16766)

Catalyst::View::Wkhtmltopdf's render() method builds a shell command via plain string interpolation and executes it through backticks with no quoting or escaping. Seven per-request render options read from the request-scoped stash are interpolated verbatim into the command string, allowing an attacker who can influence those options to achieve arbitrary command execution as the web-server user. Version 0.6.0 was released with an incomplete fix for this issue. Affected versions: - <= 0.6.0 We recommend updating to: 0.6.1. CVSS 9.8 · our assessment: act_now Reference: https://github.com/robrwo/Catalyst-View-Wkhtmltopdf/security/advisories/GHSA-42w4-jj8w-6p98 Details: https://vuln.today/cve/CVE-2026-16766