Which versions of DHTMLX PDF Export Module are affected by CVE-2026-41553?

DHTMLX PDF Export Module (versions prior to 0.7.6) contains a critical unauthenticated remote code execution vulnerability affecting Node.js backend servers used by Gantt and Scheduler applications.. A patch is available.

How to fix or mitigate CVE-2026-41553?

Within 24 hours: Identify all applications and servers using DHTMLX PDF Export Module and document current versions; implement network-level restrictions to limit access to affected APIs. Within 7 days: Upgrade DHTMLX PDF Export Module to version 0.7.6 or later across all production and non-production environments; validate functionality post-upgrade. Within 30 days: Conduct security audit of all Node.js endpoints using this module; review logs for suspicious 'data' parameter submissions; implement input validation and sanitization controls independent of vendor fixes.

DHTMLX PDF Export Module CVE-2026-41553

Q: What is the CVSS score of CVE-2026-41553?

CVE-2026-41553 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-30537 CRITICAL

OS Command Injection (CWE-78)

2026-05-15 CERT-PL

GHSA-qc73-55rc-fgph

Command Injection RCE Node.js

10.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

May 15, 2026 - 14:02 EUVD

Analysis Generated

May 15, 2026 - 13:30 vuln.today

CVSS changed

May 15, 2026 - 13:22 NVD

10.0 (CRITICAL)

CVE Published

May 15, 2026 - 12:31 nvd

CRITICAL 10.0

DescriptionCVE.org

PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Remote Code Execution due to lack of "data" parameter sanitization. An unauthenticated attacker can inject the malicious JavaScript code to the parameter whose value is processed by Node.js and subsequently executed. This can lead to server compromise.

This issue was fixed in PDF Export Module version 0.7.6.

AnalysisAI

Remote code execution in DHTMLX PDF Export Module (used by Gantt and Scheduler) allows unauthenticated attackers to inject malicious JavaScript into unsanitized 'data' parameter, achieving arbitrary code execution on Node.js backend servers. Critical vulnerability (CVSS 4.0: 10.0) with complete system compromise potential affecting server confidentiality, integrity, and availability. Vendor-released patch available in version 0.7.6. No confirmed active exploitation (not in CISA KEV), but command injection via web-accessible APIs typically sees rapid weaponization once disclosed.

Technical ContextAI

DHTMLX PDF Export Module is a server-side Node.js component that generates PDF exports for Gantt charts and Scheduler views. The vulnerability stems from CWE-78 (OS Command Injection) where the 'data' parameter - likely containing user-supplied content for PDF generation - is passed unsanitized to Node.js execution contexts. In Node.js environments, improper input handling can lead to eval()-like execution, child_process spawning, or template injection scenarios where attacker-controlled strings become executable code. The module processes export requests from client-side DHTMLX components, creating a network-accessible attack surface. Affected CPE (cpe:2.3:a:dhtmlx:pdf_export_module:*:*:*:*:*:*:*:*) indicates all versions prior to 0.7.6 are vulnerable across any deployment using DHTMLX Gantt or Scheduler with PDF export functionality enabled.

RemediationAI

Immediate upgrade to DHTMLX PDF Export Module version 0.7.6 required (vendor-released patch: version 0.7.6 per https://docs.dhtmlx.com/gantt/guides/pdf-export-module-whatsnew/#076). Review all DHTMLX Gantt and Scheduler deployments to identify PDF export service usage and prioritize patching. If immediate upgrade is not feasible, implement these compensating controls with noted trade-offs: (1) Disable PDF export endpoints entirely at web server or application firewall level - eliminates attack surface but removes legitimate functionality; (2) Restrict PDF export service network access to authenticated internal users only via IP allowlisting or VPN requirement - reduces exposure but does not eliminate risk from insider threats or compromised credentials; (3) Deploy Web Application Firewall (WAF) rules to block requests containing JavaScript code patterns, Node.js function names (eval, require, child_process), or shell metacharacters in 'data' parameter - provides defense-in-depth but may be bypassed via encoding or obfuscation techniques. Monitor Node.js process execution logs for anomalous child process spawning or unexpected module loading as potential exploitation indicators. No compensating control substitutes for patching given unauthenticated RCE severity.