CVE-2026-110642

Deferred Deferred - Pending Action

OS Command Injection in xhtml2pdf

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: VulnCheck

Description

xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer() that allows attackers to execute commands by interpolating unescaped file names into os.system. Attackers can supply an input file whose name contains a double quote and shell metacharacters, which runs OS commands as the invoking user when the pisa tool is used with -s/--start-viewer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110642

EUVD

EUVD-2026-101270

Affected Vendors & Products

Vendor	Product	Version / Range
xhtml2pdf	xhtml2pdf	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability is an OS command injection flaw in xhtml2pdf versions before 0.2.19. It occurs in the pisa.startViewer() function where attackers can execute arbitrary commands by supplying a file name containing a double quote and shell metacharacters. When the pisa tool is used with the -s or --start-viewer flag, the malicious file name is passed to os.system() without proper escaping, allowing command execution as the invoking user.

Detection Guidance

Check if xhtml2pdf versions before 0.2.19 are installed by running: pip show xhtml2pdf. If installed, verify if the application uses pisa.startViewer() with -s or --start-viewer flags. Inspect command execution logs for unexpected shell commands triggered by file names containing quotes or shell metacharacters.

Impact Analysis

If you use xhtml2pdf versions before 0.2.19 with the -s or --start-viewer flag, an attacker could execute arbitrary commands on your system. This could lead to data theft, system compromise, or unauthorized access. The impact depends on the user's privileges, but high-severity CVSS scores indicate significant risk.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations using vulnerable versions may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Upgrade xhtml2pdf to version 0.2.19 or later immediately. If upgrading is not possible, avoid using the -s or --start-viewer flags with pisa.startViewer(). Review and sanitize all file names passed to the function to prevent command injection.

Hi! I’m here to help you understand CVE-2026-110642. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70