CVE-2026-19279
Received Received - Intake

Command Injection in MIMICLab mcp-pdf-vision

Publication date: 2026-08-08

Last updated on: 2026-08-08

Assigner: VulDB

Description
A vulnerability was identified in MIMICLab mcp-pdf-vision 1.1.0. The impacted element is the function load_pdf of the file src/index.ts. Such manipulation of the argument pdfPath/sessionId leads to command injection. The attack can only be performed from a local environment. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-08
Last Modified
2026-08-08
Generated
2026-08-08
AI Q&A
2026-08-08
EPSS Evaluated
N/A
NVD
CVE-2026-19279
EUVD
EUVD-2026-54778

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mimiclab mcp-pdf-vision 1.1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a command injection flaw in MIMICLab mcp-pdf-vision 1.1.0. It occurs in the load_pdf function of src/index.ts where user-controlled inputs pdfPath and sessionId are directly embedded into shell commands without sanitization. Attackers can exploit this by injecting shell metacharacters or commands to execute arbitrary code on the local system.

Detection Guidance

Check if mcp-pdf-vision 1.1.0 is installed by running: npm list -g mcp-pdf-vision or npm list mcp-pdf-vision. Inspect the source code for the load_pdf function in src/index.ts for unsafe command construction using execAsync with user-controlled inputs like pdfPath or sessionId.

Impact Analysis

An attacker with local access could execute arbitrary commands on your system through the vulnerable PDF processing functions. This could lead to unauthorized file access, data exfiltration, or system compromise. The impact is limited to local environments as the attack requires local access.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized local command execution, potentially leading to data breaches or unauthorized access to sensitive information. Organizations using this tool may fail to meet security controls required by GDPR, HIPAA, or other standards that mandate protection against command injection and unauthorized local access.

Mitigation Strategies

Stop using mcp-pdf-vision 1.1.0 immediately. Update to a patched version if available. If not, remove the tool and avoid using it until a fix is released. Validate all user inputs strictly and avoid shell command interpolation with user-controlled values.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19279. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart