CVE-2026-78637: Fdawgs node-poppler Argument Injection index.js pdfUnite argument injection
A vulnerability was detected in Fdawgs node-poppler up to 9.1.2/10.0.1. The impacted element is the function pdfInfo/pdfToText/pdfToCairo/pdfToPpm/pdfImages/pdfToHtml/pdfToPs/pdfFonts/pdfDetach/pdfAttach/pdfSeparate/pdfUnite of the file src/index.js of the component Argument Injection Handler. Performing a manipulation of the argument filepath results in argument injection. The attack may be initiated remotely. The patch is named db6e3f79d3beb20601be7e59669c39811ae3c330. It is recommended to apply a patch to fix this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Fdawgs node-popplerto a version that resolves this vulnerability.Fixed in 9.1.2/10.0.1Patch db6e3f79d3beb20601be7e59669c39811ae3c330
Event History
Frequently Asked Questions
What attacker access is required for exploitation?
The vulnerability is remotely exploitable and requires no privileges or user interaction. Exploitation depends on the attacker being able to influence the file_path argument supplied to an affected node-poppler function.
What is the expected impact if exploitation succeeds?
The published severity vector indicates low-impact compromise of confidentiality, integrity, and availability. The scope is unchanged.
What should teams do if they use affected functionality?
Apply the patch identified as db6e3f79d3beb20601be7e59669c39811ae3c330. Prioritize applications that pass externally influenced file paths to the affected functions.