CVE-2026-110636

pypdftk through 0.5 contains an OS command injection vulnerability in fill form(), dump data fields(), and pdftk cmd util() that builds shell commands from caller-supplied paths. Attackers controlling pdf path or out file can inject shell metacharacters interpreted by subprocess.Popen with shell=True to execute OS commands as the Python process.