CVE-2021-43113

Name of the Vulnerable Software and Affected Versions iText versions prior to 7.1.17

Description The issue allows command injection via a CompareTool filename that is mishandled on the gs (aka Ghostscript) command line in GhostscriptHelper.java. This can occur when a malicious filename is provided to the CompareTool, potentially leading to the execution of arbitrary commands.

Recommendations For versions prior to 7.1.17, update to version 7.1.17 or later to resolve the issue. As a temporary workaround, consider restricting access to the GhostscriptHelper.java class or disabling the CompareTool functionality until a patch is applied. Avoid using potentially malicious filenames with the CompareTool to minimize the risk of exploitation.