xhtml2pdf EUVD-2026-101270

Exploitation requires that the pisa command-line tool be invoked with the -s or --start-viewer option against a file whose name is attacker-controlled and contains a double quote plus shell metacharacters; the vulnerable os.system('open "%s"') path in startViewer is reached only in that viewer-launch mode. Limiting factors: this is a local vector (AV:L) requiring the attacker to influence the processed filename, and it requires user interaction (UI:P) - a user or job must actually run the viewer. It does not affect the default programmatic HTML-to-PDF conversion API when the start-viewer feature is not used, and it runs only with the privileges of the invoking user. Affected versions are xhtml2pdf before 0.2.19.

This is a genuine but conditionally-exploitable command injection (CWE-78) whose real-world priority is moderate rather than urgent. The vendor-provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H, score 8.5) is internally consistent with the description: the flaw is LOCAL (AV:L) because it triggers only when a user runs the pisa CLI with -s/--start-viewer on an attacker-controlled file, and requires passive user interaction (UI:P) - the victim must invoke the viewer. The high impact (full C/I/A compromise as the invoking user) justifies the elevated base score. No EPSS score, KEV listing, or public exploit was provided in the input, so there is no signal of active or widespread exploitation; this is NOT confirmed actively exploited and no public exploit is identified at time of analysis. The signals are coherent - no contradiction between vector and description - but note the high CVSS is driven by impact, not by ease or reach: it is not a remotely-triggerable, mass-exploitable issue. The root cause is confirmed by the source diff (os.system with an unescaped interpolated filename, replaced by subprocess.run with an argument list). Treat as a prompt-to-patch library-update item, not a fire-drill.

An attacker crafts a file with a name containing a double quote and shell metacharacters (e.g. output";id;".pdf) and gets it onto a system where someone converts/opens it. When a user or automated job runs the pisa tool with -s/--start-viewer, startViewer interpolates the filename into os.system('open "%s"'), breaking out of the quoting and executing arbitrary commands as the invoking user. No public exploit code is identified, but the fixing diff publicly documents the exact vulnerable construct.