EUVD-2026-57696
GHSA-56v3-4wcg-g28h
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N
AV:N reflects worst-case deployment in web applications where network-supplied input reaches path arguments; PR:N and UI:N because the attacker's HTTP request alone triggers exploitation without requiring any local access or victim interaction.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
4DescriptionCVE.org
PDF::WebKit versions through 1.2 for Perl allow OS command injection via a 2-arg open() of the output path in to_pdf and of stylesheet paths in _style_tag_for.
to_pdf reads the generated PDF back from its path argument, and _style_tag_for reads each entry of the stylesheets list, by assigning the path to a local @ARGV and reading it with the diamond operator, which opens each @ARGV element with Perl's 2-arg open(). A value that begins or ends with a pipe ("| cmd", "cmd |") is run as a command rather than opened as a file, and one that begins with a redirect ("> path", ">> path") opens that path for write or append. to_file forwards its path argument to to_pdf and reaches the same read.
Any caller that forwards untrusted input as the output path or as a stylesheets entry can run a command under the process UID; with the "cmd |" form the command's output is returned in place of the PDF, and with the "> path" form the named file is truncated. Stylesheets may only be added to an HTML source, so a URL or file source exposes the output path alone.
AnalysisAI
OS command injection in PDF::WebKit for Perl (versions through 1.2) allows arbitrary command execution under the process UID when untrusted input is forwarded as an output path or stylesheet path to to_pdf, to_file, or _style_tag_for. The root cause is Perl's 2-arg open() combined with the diamond operator, which interprets pipe-flanked strings (| cmd or cmd |) as shell commands and redirect-prefixed strings (> path) as file write operations rather than filenames. No public exploit code has been confirmed and the vulnerability is not listed in CISA KEV at time of analysis, but the technique exploits well-documented Perl behavior making reproduction trivial for any developer familiar with the language.
Technical ContextAI
PDF::WebKit (CPE: cpe:2.3:a:mithaldu:pdf::webkit:*:*:*:*:*:*:*:*) is a Perl CPAN module wrapping the wkhtmltopdf HTML-to-PDF renderer - notably, wkhtmltopdf itself is archived and unmaintained per its own status page (https://wkhtmltopdf.org/status.html), adding an upstream maintenance concern. The vulnerability is a textbook CWE-78 (Improper Neutralization of Special Elements Used in an OS Command) caused by misuse of Perl's 2-arg open(). The to_pdf function assigns the output path to @ARGV and reads it with the diamond operator (<>), which internally calls 2-arg open() on each element; _style_tag_for does the same for each stylesheet path. In Perl, 2-arg open() performs shell metacharacter expansion: a value ending with | spawns a read pipe to a command (returning its stdout in place of file content), a value beginning with | spawns a write pipe, and > or >> prefixes open the named file for write or append. The canonical fix is to replace 2-arg open() with 3-arg open(my $fh, '<', $path) or sysopen(), which treat the path as a literal filename with no metacharacter interpretation.
RemediationAI
Apply the CPANSec patch for PDF::WebKit 1.2 available at https://security.metacpan.org/patches/P/PDF-WebKit/1.2/CVE-2026-17431-r1.patch - no specific patched release version number was independently confirmed in the available data, so monitor the CPAN distribution at https://metacpan.org/ for a formal updated release. As a compensating control until a patched release is available, sanitize all path arguments before passing them to to_pdf, to_file, or _style_tag_for: reject any value containing a leading or trailing pipe character (|) or a leading > or >> using an explicit denylist, or preferably apply an allowlist permitting only safe filesystem path characters. Generate output paths internally using File::Temp rather than accepting them from user input, which eliminates the output path injection vector entirely. Restrict the UID of the process running PDF::WebKit to the minimum necessary privilege level to limit blast radius if injection occurs. For stylesheet injection specifically, resolve stylesheet references to pre-approved absolute paths at the application layer rather than forwarding raw user input.
Argument injection in PDF::WebKit through version 1.2 (Perl module, CPE mithaldu:pdf::webkit) lets an attacker who contr
IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to execute arbitrary code or cause a denial
IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to execute arbitrary code or cause a denial
IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to execute arbitrary code or cause a denial
IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to execute arbitrary code or cause a denial
IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to execute arbitrary code or cause a denial
IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to execute arbitrary code or cause a denial
IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to execute arbitrary code or cause a denial
IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to execute arbitrary code or cause a denial
IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to execute arbitrary code or cause a denial
IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly ha
IrfanView version 4.44 (32bit) with PDF plugin version 4.43 allows attackers to cause a denial of service or possibly ha
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today