CVE-2026-41553

Name of the Vulnerable Software and Affected Versions PDF Export Module versions prior to 0.7.6

Description The PDF Export Module used in DHTMLX Gantt and Scheduler allows unauthenticated remote code execution. The issue stems from insufficient sanitization of the data parameter. An attacker can inject malicious JavaScript code into this parameter, which is then processed and executed by Node.js, potentially leading to full server compromise.

Recommendations Update to version 0.7.6. As a temporary workaround, restrict access to the data parameter within the PDF Export Module to minimize the risk of exploitation.