node-poppler CVE-2026-78637

Exploitation requires that attacker-controlled or user-supplied input reaches the file_path parameter of any affected node-poppler wrapper function without sanitization or path validation. The trigger condition is a file_path value beginning with a hyphen character (-), causing the underlying poppler CLI binary to misinterpret the path as a command-line option rather than a positional argument. Applications that construct file_path values internally from trusted sources (e.g., server-generated UUIDs, database-stored paths) are not exploitable regardless of network exposure. The CVSS vector assigns PR:N and UI:N, reflecting library-level assumptions; actual exploitation is gated by whether the consuming application exposes file path selection to external input. Non-default configuration is not required - any call to the affected functions with an attacker-influenced file_path is sufficient.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L) scores 6.9 and reflects a worst-case scenario where user-supplied input directly reaches the file_path parameter without sanitization. Real-world risk is heavily application-dependent: deployments that accept user-provided filenames or paths (e.g., file upload APIs that process PDFs) represent a genuine exploitation surface, while applications using only internally-generated paths are not exploitable. No EPSS probability data was provided, KEV status is absent, and no public POC or exploit code has been identified, collectively suggesting this is not under active or widespread exploitation at time of analysis. The limited impact metrics (C:L/I:L/A:L) indicate partial rather than full system compromise - injected options may alter poppler binary behavior but are constrained to what the targeted binary accepts. This is a moderate-priority patch with urgency highest for applications that accept user-supplied file paths.

An attacker submitting a PDF file through an application's upload endpoint names the file -verbose or supplies a path value such as --allow-setuid that begins with a hyphen; node-poppler passes this value as a CLI argument to the underlying poppler binary (e.g., pdftotext), which parses it as an option flag rather than a filename, altering the binary's behavior in a manner controlled by the attacker. Depending on which poppler utility is invoked and which flags are accepted, this could cause unintended file reads, option-flag side effects, or partial data disclosure. No public exploit code has been identified, but the attack is conceptually straightforward given the public patch diff.