CVE-2026-16770
Received Received - Intake

PDF::WebKit Command Injection via Meta Tags

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: CPANSec

Description
PDF::WebKit versions through 1.2 for Perl allow argument injection into wkhtmltopdf via meta tags in the source document. For an HTML string or file source, the constructor collects every <meta name="pdf-webkit-KEY" content="VALUE"> element in the document head through _pdf_webkit_meta_tags and turns each one into a wkhtmltopdf command line option. KEY is normalized to an option name matching --[a-z0-9-]+ but is not checked against an allow list, VALUE is passed through unchanged as the argument that follows it, and a VALUE of "yes" emits the option as a bare flag. BUILD merges the meta derived options last, so they also override the module defaults and the options passed to new. Switches such as --enable-local-file-access and --cookie-jar are reachable this way. The renderer is executed with an argument list rather than a shell command, so this is argument injection and not shell injection. Any caller that renders untrusted HTML lets the document choose the renderer's options and override those set by the application, including options that read local files into the resulting PDF or write to a chosen path. A URL source is not scanned, and the scan is skipped when XML::LibXML, a recommended dependency, is not installed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-16770
EUVD
EUVD-2026-57695

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
kingpong pdf_webkit 1.2
wkhtmltopdf wkhtmltopdf *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-88 The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-16770 is an argument injection flaw in the Perl module PDF::WebKit, which acts as a wrapper for wkhtmltopdf. The vulnerability occurs because the module automatically parses HTML source for meta tags and converts them into wkhtmltopdf command-line options without any filtering or allow-list restrictions. Attackers can inject malicious options by embedding specially crafted meta tags in HTML input, which are then executed when the PDF is rendered. This bypasses application-defined settings and allows control over the renderer's behavior.

Detection Guidance

Check for Perl applications using PDF::WebKit versions through 1.2. Inspect HTML input sources for meta tags with names starting with pdf-webkit- (e.g., grep -r 'meta name="pdf-webkit-' /path/to/html/files). Use the command 'perl -MPDF::WebKit -e "print $PDF::WebKit::VERSION"' to verify installed versions.

Impact Analysis

This vulnerability allows attackers to bypass security restrictions in wkhtmltopdf. For example, they could inject options to read local files into the generated PDF or write to arbitrary file paths. If your application processes untrusted HTML input and converts it to PDF using PDF::WebKit, an attacker could manipulate the output or access sensitive local files. The impact depends on how the module is used in your environment.

Compliance Impact

This vulnerability could lead to violations of GDPR or HIPAA by enabling unauthorized access to sensitive data. For instance, an attacker could inject options to read local files containing personal or health information, which would breach confidentiality requirements. Organizations using PDF::WebKit to process sensitive data must address this flaw to maintain compliance with data protection regulations.

Mitigation Strategies

Upgrade PDF::WebKit to a patched version with the allow-list fix. If upgrading is not possible, sanitize HTML input to remove meta tags or disable the meta tag parsing feature. Avoid using untrusted HTML with PDF::WebKit entirely.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16770. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart