CVE-2026-16770

Name of the Vulnerable Software and Affected Versions PDF::WebKit versions prior to 1.3

Description PDF::WebKit allows argument injection into wkhtmltopdf through meta tags in the source document. When processing an HTML string or file source, the constructor uses the pdf webkit meta tags function to collect <meta name="pdf-webkit-KEY" content="VALUE"> elements from the document head and convert them into wkhtmltopdf command line options. Because the KEY is not validated against an allow list and the VALUE is passed unchanged, an attacker providing untrusted HTML can override application settings. This allows the use of switches such as --enable-local-file-access and --cookie-jar, potentially enabling the reading of local files into the resulting PDF or writing to arbitrary paths. This issue occurs because the renderer is executed with an argument list rather than a shell command. The scan is skipped if the recommended dependency XML::LibXML is not installed, and URL sources are not scanned.

Recommendations Update PDF::WebKit to a version later than 1.2. As a temporary mitigation, avoid rendering untrusted HTML sources or ensure that the XML::LibXML dependency is not installed to skip the meta tag scanning process.