CVE-2026-17431

Name of the Vulnerable Software and Affected Versions PDF::WebKit versions through 1.2

Description OS command injection is possible when untrusted input is passed as the output path or as a stylesheet entry. The issue occurs because the to pdf() function reads the generated PDF from its path argument, and the style tag for() function reads stylesheet entries by assigning the path to a local @ARGV and using the diamond operator, both of which utilize Perl's 2-arg open(). If a value starts or ends with a pipe (| cmd, cmd |), it is executed as a command; if it starts with a redirect (> path, >> path), the specified file is opened for writing or appending. Additionally, the to file() function forwards its path argument to to pdf(), leading to the same issue. An attacker can execute commands under the process UID, potentially returning command output in place of the PDF or truncating files.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.