1. Home
  2. CVE Database
  3. CVE-2016-4991
CRITICAL · 9.8

CVE-2016-4991

Input passed to the Pdf() function is shell escaped and passed to child_process.exec() during PDF rendering. However, the shell escape does not properly encode all special characters, namely, semicolo...

Vulnerability Description

Input passed to the Pdf() function is shell escaped and passed to child_process.exec() during PDF rendering. However, the shell escape does not properly encode all special characters, namely, semicolon and curly braces. This can be abused to achieve command execution. This problem affects nodepdf 1.3.0.

CVSS Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
Nodepdf ProjectNodepdf1.3.0

Related Weaknesses (CWE)

CWE-77

References

FAQ

What is CVE-2016-4991?

CVE-2016-4991 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Input passed to the Pdf() function is shell escaped and passed to child_process.exec() during PDF rendering. However, the shell escape does not properly encode all special characters, namely, semicolo...

How severe is CVE-2016-4991?

CVE-2016-4991 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2016-4991?

Check the references section above for vendor advisories and patch information. Affected products include: Nodepdf Project Nodepdf.