Pypdftk
Monthly
OS command injection in the Python library pypdftk (through version 0.5) lets attackers who control the pdf_path or out_file arguments of fill_form(), dump_data_fields(), or pdftk_cmd_util() execute arbitrary operating-system commands with the privileges of the hosting Python process. The three functions concatenate caller-supplied paths into a command string using '%s' formatting and pass it to subprocess.Popen with shell=True, so shell metacharacters embedded in a filename or path are interpreted by the shell rather than treated as literal arguments. CVSS v4.0 scores the flaw 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N), and the independent assessment concurs with CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, but real-world reachability is bounded by the calling application - pypdftk is a library, not a network service, so exploitation requires the embedding application to forward untrusted input into those parameters, and no public exploit code has been identified at time of analysis. No CISA KEV entry exists for this CVE, and a source-level fix is available from upstream via pull request 57, which replaces string command construction with argument lists.
OS command injection in the Python library pypdftk (through version 0.5) lets attackers who control the pdf_path or out_file arguments of fill_form(), dump_data_fields(), or pdftk_cmd_util() execute arbitrary operating-system commands with the privileges of the hosting Python process. The three functions concatenate caller-supplied paths into a command string using '%s' formatting and pass it to subprocess.Popen with shell=True, so shell metacharacters embedded in a filename or path are interpreted by the shell rather than treated as literal arguments. CVSS v4.0 scores the flaw 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N), and the independent assessment concurs with CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, but real-world reachability is bounded by the calling application - pypdftk is a library, not a network service, so exploitation requires the embedding application to forward untrusted input into those parameters, and no public exploit code has been identified at time of analysis. No CISA KEV entry exists for this CVE, and a source-level fix is available from upstream via pull request 57, which replaces string command construction with argument lists.