CVE-2016-4991

Published: Jul 28, 2022Modified: Nov 21, 2024

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Input passed to the Pdf() function is shell escaped and passed to child_process.exec() during PDF rendering. However, the shell escape does not properly encode all special characters, namely, semicolon and curly braces. This can be abused to achieve command execution. This problem affects nodepdf 1.3.0.

Affected (1)

Products: Nodepdf Project: Nodepdf

Nodepdf Project

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Nodepdf Project Nodepdf	Version 1.3.0

Related CWEs

Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

References (2)

https://lf.lc/cve/cve-2016-4991/

Source: secalert@redhat.com

ExploitThird Party Advisory

https://lf.lc/cve/cve-2016-4991/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.