CVE-2026-16766

Name of the Vulnerable Software and Affected Versions Catalyst::View::Wkhtmltopdf versions prior to 0.6.1

Description Shell command injection is possible via PDF render options because options are passed directly to the wkhtmltopdf command without sanitization. Web applications that pass user-controlled variables such as page size, orientation, or margins without validation are susceptible to remote code execution (RCE).

Recommendations Update Catalyst::View::Wkhtmltopdf to version 0.6.1 or later. As a temporary mitigation, avoid passing user-controlled input to the page size, orientation, and margins options.