What is the CVSS score of CVE-2026-26830?

CVE-2026-26830 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Node.js are affected by CVE-2026-26830?

A critical remote code execution vulnerability in the pdf-image npm package allows attackers to execute arbitrary system commands without authentication on any system using this dependency.

How to fix or mitigate CVE-2026-26830?

Within 24 hours: Identify all applications and dependencies using pdf-image across your infrastructure; immediately disable PDF processing functionality if feasible or restrict it to internal/trusted sources only. Within 7 days: Develop and test a remediation plan including package replacement (evaluate alternatives like pdfkit, ghostscript, or commercial solutions), code review of pdf-image usage patterns, and prioritized deployment timeline. Within 30 days: Complete migration off pdf-image to a patched alternative, conduct security testing of replacement implementation, and deploy across all production systems.

Node.js CVE-2026-26830

EUVD-2026-15457 CRITICAL

Code Injection (CWE-94)

2026-03-25 mitre

Node.js Command Injection RCE Code Injection

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 25, 2026 - 15:16 euvd

EUVD-2026-15457

Analysis Generated

Mar 25, 2026 - 15:16 vuln.today

CVE Published

Mar 25, 2026 - 00:00 nvd

CRITICAL 9.8

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

10 npm packages depend on pdf-image (10 direct, 0 indirect)

Ecosystem-wide dependent count for version 2.0.0.

DescriptionCVE.org

pdf-image (npm package) through version 2.0.0 allows OS command injection via the pdfFilePath parameter. The constructGetInfoCommand and constructConvertCommandForPage functions use util.format() to interpolate user-controlled file paths into shell command strings that are executed via child_process.exec()

AnalysisAI

The pdf-image npm package through version 2.0.0 contains an OS command injection vulnerability in the pdfFilePath parameter. Attackers can exploit this remotely without authentication by injecting malicious commands through file path inputs that are passed unsafely to shell commands via child_process.exec(). A proof-of-concept exploit is publicly available on GitHub (zebbernCVE/CVE-2026-26830), significantly increasing exploitation risk.

Technical ContextAI

The pdf-image npm package is a Node.js library that converts PDF files to images by wrapping ImageMagick/GraphicsMagick command-line tools. The vulnerability stems from improper input sanitization in the constructGetInfoCommand and constructConvertCommandForPage functions, which use util.format() to construct shell commands with user-supplied file paths. These unsanitized strings are then passed to child_process.exec(), enabling classic OS command injection attacks. This represents a CWE-78 class vulnerability (OS Command Injection) where user input is incorporated into system commands without proper validation or escaping. The CPE data indicates the affected product is the pdf-image npm package, though specific version details are limited in the CPE string.

RemediationAI

Immediately upgrade the pdf-image npm package to a version newer than 2.0.0 if a patched version becomes available. Monitor the GitHub repository at https://github.com/mooz/node-pdf-image and npm package page at https://www.npmjs.com/package/pdf-image for security updates. As an interim mitigation, implement strict input validation and sanitization on all file path parameters before passing them to pdf-image functions, specifically whitelisting allowed characters and rejecting any input containing shell metacharacters such as semicolons, pipes, backticks, or command substitution syntax. Consider replacing this package with alternative PDF processing libraries that use safer command execution methods or sandboxed execution environments. Restrict the application's filesystem access permissions and run the Node.js process with minimal privileges to limit the impact of successful exploitation.