CVE-2026-107802

Deferred Deferred - Pending Action

Command Injection in SumatraPDF

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: GitHub, Inc.

Description

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, src/SelectionTranslate.cpp embeds selected or pasted translation text in quoted Windows command lines using incomplete quote-only escaping. The affected BuildGrokTranslateCmdLineTemp(), BuildClaudeTranslateCmdLineTemp(), and BuildCodexTranslateCmdLineTemp() functions can allow attacker-controlled text to inject model, working-directory, approval, or sandbox-bypass flags when the corresponding agentic CLI backend is installed and used. No broader impact is claimed beyond the advisory-supported conditions. No fixed version is available as of this review.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-08

Last Modified

2026-10-08

Generated

2026-10-09

AI Q&A

2026-10-09

EPSS Evaluated

N/A

NVD

CVE-2026-107802

Affected Vendors & Products

Vendor	Product	Version / Range
sumatrapdfreader	sumatrapdf	<= 3.6.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-88	The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Attack-Flow Graph

Executive Summary

SumatraPDF versions 3.6.1 and earlier have a flaw in how selected or pasted translation text is embedded in Windows command lines. The issue occurs in functions that build command lines for translation tools. These functions do not properly escape quotes, allowing attacker-controlled text to inject malicious flags that could bypass security controls or execute unintended commands.

Detection Guidance

This vulnerability involves command injection through improperly escaped text in SumatraPDF's translation functions. To detect it, monitor for unusual command-line arguments in SumatraPDF processes or translation agent backends. Check for unexpected model, directory, or sandbox flags in logs or process listings. No specific commands are provided in the CVE details.

Impact Analysis

If you use SumatraPDF with agentic CLI backends for translation, an attacker could craft malicious translation text to execute unauthorized commands, bypass sandboxing, or manipulate file operations. This requires the attacker to control the translation text input and have the backend tools installed.

Compliance Impact

The vulnerability involves command injection through improperly escaped text in Windows command lines, which could allow attackers to bypass security controls or execute unauthorized actions. This may impact compliance with standards requiring secure data handling, such as GDPR (data protection) or HIPAA (health information security), by enabling unauthorized access or manipulation of sensitive data.

Mitigation Strategies

Immediately stop using SumatraPDF versions 3.6.1 and earlier. Uninstall the software if possible. Avoid using agentic CLI backends with SumatraPDF until a patched version is released.

Hi! I’m here to help you understand CVE-2026-107802. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70