What is the CVSS score of CVE-2026-36576?

CVE-2026-36576 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of docker-wkhtmltopdf-aas are affected by CVE-2026-36576?

openlabs docker-wkhtmltopdf-aas versions through commit 9f50579 contain a critical unauthenticated remote code execution vulnerability in the PDF conversion endpoint that allows attackers to execute…

How to fix or mitigate CVE-2026-36576?

24 hours: Immediately isolate all systems running openlabs docker-wkhtmltopdf-aas from production networks and internet-facing traffic; initiate log review for suspicious POST requests to the PDF endpoint and preserve evidence for forensic analysis. 7 days: Identify and test alternative PDF conversion solutions with current security patches (e.g., official wkhtmltopdf, commercial PDF-as-a-Service providers); finalize migration plan and deployment timeline. 30 days: Complete migration of all PDF processing workloads to patched alternative solution; remove all openlabs docker-wkhtmltopdf-aas container instances; conduct post-incident forensic analysis for signs of unauthorized access or data exfiltration.

docker-wkhtmltopdf-aas CVE-2026-36576

EUVD-2026-34099 CRITICAL

OS Command Injection (CWE-78)

2026-06-03 mitre

GHSA-v5gc-8cqm-ww2h

Docker Command Injection

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 03, 2026 - 19:23 vuln.today

CVSS changed

Jun 03, 2026 - 19:22 NVD

9.8 (CRITICAL)

CVE Published

Jun 03, 2026 - 00:00 nvd

CRITICAL 9.8

CVE Published

Jun 03, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

An OS command injection vulnerability in the app.py component of openlabs docker-wkhtmltopdf-aas up to commit 9f50579 allows attackers to execute arbitrary commands via a crafted POST request.

AnalysisAI

Remote command execution in openlabs docker-wkhtmltopdf-aas (up to commit 9f50579) allows unauthenticated attackers to run arbitrary OS commands by sending a crafted POST request to the app.py PDF conversion endpoint. The CVSS 9.8 rating reflects network-reachable, no-privilege, no-interaction exploitation, and while no public exploit identified at time of analysis, the referenced source line (app.py#L40) makes the injection sink trivially discoverable for any attacker reviewing the repository.

Technical ContextAI

docker-wkhtmltopdf-aas is a small Flask-based 'as-a-Service' wrapper that exposes the wkhtmltopdf binary (an HTML-to-PDF renderer built on Qt WebKit) over HTTP inside a Docker container, typically used as an internal microservice for generating PDFs from HTML or URLs. The vulnerability falls under CWE-78 (Improper Neutralization of Special Elements used in an OS Command), meaning user-controlled POST data is concatenated into a shell command invocation of wkhtmltopdf without sanitization or use of an argv-style subprocess call. The referenced line app.py#L40 indicates a single specific sink in the request handler where shell metacharacters (semicolons, backticks, $() substitution, pipes) in user input break out of the intended argument and execute as additional commands under the container's process user.

RemediationAI

No vendor-released patch identified at time of analysis - the referenced GitHub issue (#36) is the only upstream remediation signal and no fixed commit or tagged release is cited in the input. Operators should treat the public image as unsafe and either fork the repository to replace the shell-style invocation in app.py around line 40 with a list-argument subprocess.run(..., shell=False) call that passes user input as separate argv elements, or migrate to a maintained alternative such as the python wkhtmltopdf bindings or Gotenberg. Until code is fixed, restrict the container's HTTP port to a trusted internal network only (block external ingress at the reverse proxy or Docker host firewall - side effect: any legitimate external consumer breaks), put it behind an authenticating reverse proxy that strips or rejects shell metacharacters (?,;,|,`,$,&,newlines) in POST bodies (side effect: may break legitimate HTML containing those characters and is not a reliable bypass-proof control), and run the container as a non-root, read-only filesystem user with a dropped capability set and no outbound network egress to limit post-exploitation impact.