EUVD-2026-30537
GHSA-qc73-55rc-fgph
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Remote Code Execution due to lack of "data" parameter sanitization. An unauthenticated attacker can inject the malicious JavaScript code to the parameter whose value is processed by Node.js and subsequently executed. This can lead to server compromise.
This issue was fixed in PDF Export Module version 0.7.6.
AnalysisAI
Remote code execution in DHTMLX PDF Export Module (used by Gantt and Scheduler) allows unauthenticated attackers to inject malicious JavaScript into unsanitized 'data' parameter, achieving arbitrary code execution on Node.js backend servers. Critical vulnerability (CVSS 4.0: 10.0) with complete system compromise potential affecting server confidentiality, integrity, and availability. Vendor-released patch available in version 0.7.6. No confirmed active exploitation (not in CISA KEV), but command injection via web-accessible APIs typically sees rapid weaponization once disclosed.
Technical ContextAI
DHTMLX PDF Export Module is a server-side Node.js component that generates PDF exports for Gantt charts and Scheduler views. The vulnerability stems from CWE-78 (OS Command Injection) where the 'data' parameter - likely containing user-supplied content for PDF generation - is passed unsanitized to Node.js execution contexts. In Node.js environments, improper input handling can lead to eval()-like execution, child_process spawning, or template injection scenarios where attacker-controlled strings become executable code. The module processes export requests from client-side DHTMLX components, creating a network-accessible attack surface. Affected CPE (cpe:2.3:a:dhtmlx:pdf_export_module:*:*:*:*:*:*:*:*) indicates all versions prior to 0.7.6 are vulnerable across any deployment using DHTMLX Gantt or Scheduler with PDF export functionality enabled.
RemediationAI
Immediate upgrade to DHTMLX PDF Export Module version 0.7.6 required (vendor-released patch: version 0.7.6 per https://docs.dhtmlx.com/gantt/guides/pdf-export-module-whatsnew/#076). Review all DHTMLX Gantt and Scheduler deployments to identify PDF export service usage and prioritize patching. If immediate upgrade is not feasible, implement these compensating controls with noted trade-offs: (1) Disable PDF export endpoints entirely at web server or application firewall level - eliminates attack surface but removes legitimate functionality; (2) Restrict PDF export service network access to authenticated internal users only via IP allowlisting or VPN requirement - reduces exposure but does not eliminate risk from insider threats or compromised credentials; (3) Deploy Web Application Firewall (WAF) rules to block requests containing JavaScript code patterns, Node.js function names (eval, require, child_process), or shell metacharacters in 'data' parameter - provides defense-in-depth but may be bypassed via encoding or obfuscation techniques. Monitor Node.js process execution logs for anomalous child process spawning or unexpected module loading as potential exploitation indicators. No compensating control substitutes for patching given unauthenticated RCE severity.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Same weakness CWE-78 – OS Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today