What is the CVSS score of EUVD-2026-57695?

EUVD-2026-57695 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of PDF::WebKit are affected by EUVD-2026-57695?

PDF::WebKit (Perl module) versions through 1.2 contain a critical argument injection vulnerability allowing attackers controlling HTML input to execute arbitrary document-rendering commands, exposing…. A patch is available.

How to fix or mitigate EUVD-2026-57695?

Within 24 hours, identify all systems and applications running PDF::WebKit and document their current versions and data inputs; establish an inventory of which systems process untrusted or user-supplied HTML. Within 7 days, apply the vendor-released patch to PDF::WebKit following the guidance in the vendor advisory to reach a patched version, and test the update in a non-production environment to ensure compatibility with existing integrations. Within 30 days, complete full regression testing across document rendering workflows, validate that no untrusted HTML inputs bypass the patched module, and deploy updates to all production systems.

PDF::WebKit EUVD-2026-57695

| CVE-2026-16770 CRITICAL

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (CWE-88)

2026-08-12 CPANSec

GHSA-6f7m-6567-58mj

Apple Code Injection Pdf

9.8

CVSS 3.1 · Vendor: CPANSec

Severity by source

Vendor (CPANSec) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.1 CRITICAL

Reachable remotely when an app renders untrusted HTML (AV:N/AC:L/PR:N/UI:N); impact is local file read and file write (C:H/I:H) with no clear availability effect (A:N), lowering it below NVD's 9.8.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CPANSec).

CVSS VectorVendor: CPANSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 13:23 vuln.today

CVSS changed

Aug 13, 2026 - 13:22 NVD

9.8 (CRITICAL)

CVE Published

Aug 12, 2026 - 23:12 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 12, 2026 - 23:12 cve.org

CRITICAL 9.8

DescriptionCVE.org

PDF::WebKit versions through 1.2 for Perl allow argument injection into wkhtmltopdf via meta tags in the source document.

For an HTML string or file source, the constructor collects every <meta name="pdf-webkit-KEY" content="VALUE"> element in the document head through _pdf_webkit_meta_tags and turns each one into a wkhtmltopdf command line option. KEY is normalized to an option name matching --[a-z0-9-]+ but is not checked against an allow list, VALUE is passed through unchanged as the argument that follows it, and a VALUE of "yes" emits the option as a bare flag. BUILD merges the meta derived options last, so they also override the module defaults and the options passed to new. Switches such as --enable-local-file-access and --cookie-jar are reachable this way. The renderer is executed with an argument list rather than a shell command, so this is argument injection and not shell injection.

Any caller that renders untrusted HTML lets the document choose the renderer's options and override those set by the application, including options that read local files into the resulting PDF or write to a chosen path. A URL source is not scanned, and the scan is skipped when XML::LibXML, a recommended dependency, is not installed.

AnalysisAI

Argument injection in PDF::WebKit through version 1.2 (Perl module, CPE mithaldu:pdf::webkit) lets an attacker who controls the source HTML dictate the wkhtmltopdf command-line options used for rendering. Because meta tags of the form <meta name="pdf-webkit-KEY" content="VALUE"> are converted into renderer switches without an allow-list and are merged last, a malicious document can enable options like --enable-local-file-access or --cookie-jar to read local files into the output PDF or write to attacker-chosen paths. No public exploit identified at time of analysis; a vendor patch is available. NVD scores this CVSS 9.8, though real-world exposure depends on the application feeding untrusted HTML to the module.

Technical ContextAI

PDF::WebKit is a Perl wrapper around the wkhtmltopdf binary, which uses a WebKit engine to render HTML into PDF. During construction for an HTML string or file source, _pdf_webkit_meta_tags scans the document head and turns each pdf-webkit-* meta tag into a wkhtmltopdf option: the KEY is normalized to match --[a-z0-9-]+ and the CONTENT becomes the following argument (a value of "yes" emits a bare flag). This is a classic CWE-88 (argument/parameter injection) issue: untrusted input crosses into a subprocess argument vector. Notably the renderer is invoked with an explicit argument list, so this is argument injection, NOT shell injection - the attacker controls wkhtmltopdf flags but cannot directly run arbitrary shell commands. The BUILD step merges meta-derived options last, so document-supplied switches override both module defaults and options passed to new(). URL sources are not scanned, and the meta-tag scan is skipped entirely when the recommended dependency XML::LibXML is absent.

RemediationAI

Upgrade PDF::WebKit beyond 1.2 to the fixed release and apply the vendor patch published at https://security.metacpan.org/patches/P/PDF-WebKit/1.2/CVE-2026-16770-r1.patch (Patch available per vendor advisory; an exact fixed version tag beyond 1.2 is not stated in the provided data, so confirm the released version on CPAN before deploying). Until patched, the most effective compensating control is to stop passing untrusted HTML directly to the constructor: sanitize or strip <meta name="pdf-webkit-*"> tags from user-supplied documents before rendering, which neutralizes the injection at the cost of a preprocessing step. Alternatively, render only from URL sources where feasible, since URL sources are not scanned for meta tags, or explicitly disallow dangerous switches such as --enable-local-file-access and --cookie-jar at the wrapper level; be aware that disabling local-file access will break any legitimate documents that intentionally embed local assets. Do NOT rely on the absence of XML::LibXML as a control - while its absence skips the scan, it is a recommended dependency and its presence is the more secure-looking but actually vulnerable configuration. Track the upstream discussion at https://github.com/kingpong/perl-PDF-WebKit/issues/9.