pypdftk through 0.5 contains an OS command injection vulnerability in fillform(), dumpdatafields(), and pdftkcmdutil() that builds shell commands from caller-supplied paths. Attackers controlling pdfpath or outfile can inject shell metacharacters interpreted by subprocess.Popen with shell=True to execute OS commands as the Python process.