CVE-2026-17431
Received Received - Intake

Command Injection in PDF::WebKit for Perl

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: CPANSec

Description
PDF::WebKit versions through 1.2 for Perl allow OS command injection via a 2-arg open() of the output path in to_pdf and of stylesheet paths in _style_tag_for. to_pdf reads the generated PDF back from its path argument, and _style_tag_for reads each entry of the stylesheets list, by assigning the path to a local @ARGV and reading it with the diamond operator, which opens each @ARGV element with Perl's 2-arg open(). A value that begins or ends with a pipe ("| cmd", "cmd |") is run as a command rather than opened as a file, and one that begins with a redirect ("> path", ">> path") opens that path for write or append. to_file forwards its path argument to to_pdf and reaches the same read. Any caller that forwards untrusted input as the output path or as a stylesheets entry can run a command under the process UID; with the "cmd |" form the command's output is returned in place of the PDF, and with the "> path" form the named file is truncated. Stylesheets may only be added to an HTML source, so a URL or file source exposes the output path alone.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-17431
EUVD
EUVD-2026-57696

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
kingpong perl_pdf_webkit 1.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a command injection flaw in the Perl PDF::WebKit library versions through 1.2. It occurs because the code uses a two-argument form of Perl's open() function combined with the diamond operator (<>) on ARGV. This allows attackers to inject shell commands by providing paths ending with pipe characters (|) or redirection symbols (>). The vulnerable functions are to_pdf and _style_tag_for, which process output paths and stylesheet paths respectively.

Detection Guidance

Check if perl-PDF-WebKit is installed using 'cpan -D PDF::WebKit'. Inspect code for use of 2-arg open() with diamond operator in paths. Monitor for unexpected command execution or file writes in logs.

Impact Analysis

If you use the vulnerable PDF::WebKit library, an attacker could execute arbitrary commands on your system with the same privileges as the process running the library. This could lead to complete system compromise, data theft, or further network infiltration. The impact depends on how the library is used in your application.

Compliance Impact

This vulnerability could lead to violations of GDPR (data protection) and HIPAA (health information privacy) by enabling unauthorized access to sensitive data. If exploited, it may result in data breaches that require regulatory reporting and potential fines. Organizations using this library must address it to maintain compliance.

Mitigation Strategies

Apply the official patch from MetaCPAN replacing 2-arg open() with 3-arg open() in to_pdf and _style_tag_for functions. Remove perl-PDF-WebKit if unused or restrict input to trusted sources.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-17431. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart