CVE-2026-110642: xhtml2pdf before 0.2.19 OS Command Injection via startViewer File Name
xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer() that allows attackers to execute commands by interpolating unescaped file names into os.system. Attackers can supply an input file whose name contains a double quote and shell metacharacters, which runs OS commands as the invoking user when the pisa tool is used with -s/--start-viewer.
Affected Software
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An attacker must be able to supply or influence the input file name passed to the pisa tool. The vulnerable invocation also has to use the -s or --start-viewer option, which calls pisa.startViewer().
Who is exposed to this issue?
Systems running xhtml2pdf versions before 0.2.19 are exposed when they invoke pisa with -s/--start-viewer on attacker-controlled or untrusted file names. Commands execute with the privileges of the user running the tool.
Is the default pisa invocation affected?
The provided information identifies exploitation specifically when pisa is used with -s/--start-viewer. It does not establish that invocations without that option are affected.
What can be done before upgrading?
Avoid using the -s/--start-viewer option with untrusted or attacker-influenced input file names. Ensure file names containing double quotes or shell metacharacters cannot reach the pisa invocation.