Node Poppler
Monthly
Argument injection in Fdawgs node-poppler affects all ten PDF-processing wrapper functions (pdfToText, pdfToCairo, pdfToPpm, and others) in src/index.js across versions up to 9.1.2 and 10.0.1, allowing a remote attacker who can supply a hyphen-prefixed file_path value to inject arbitrary CLI options into the underlying poppler binary invocations. The CVSS 4.0 score of 6.9 reflects network-reachable exploitation with no authentication required at the library level, though real-world exploitability depends on whether the application exposes file_path selection to external input. No public exploit has been identified and no CISA KEV listing exists; a fix is available via upstream GitHub commit db6e3f79d3beb20601be7e59669c39811ae3c330.
Argument injection in Fdawgs node-poppler affects all ten PDF-processing wrapper functions (pdfToText, pdfToCairo, pdfToPpm, and others) in src/index.js across versions up to 9.1.2 and 10.0.1, allowing a remote attacker who can supply a hyphen-prefixed file_path value to inject arbitrary CLI options into the underlying poppler binary invocations. The CVSS 4.0 score of 6.9 reflects network-reachable exploitation with no authentication required at the library level, though real-world exploitability depends on whether the application exposes file_path selection to external input. No public exploit has been identified and no CISA KEV listing exists; a fix is available via upstream GitHub commit db6e3f79d3beb20601be7e59669c39811ae3c330.