p PatchFirst

CVE-2026-110642

CVE-2026-110642 · xhtml2pdf before 0.2.19 OS Command Injection via startViewer File Name

This page contains facts from public vulnerability sources. Check the original advisory before updating.

xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer() that allows attackers to execute commands by interpolating unescaped file names into os.system. Attackers can supply an input file whose name contains a double quote and shell metacharacters, which runs OS commands as the invoking user when the pisa tool is used with -s/--start-viewer.

CVSS 8.5 · High · EPSS 1.1% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • xhtml2pdf

    Versions
    • ≥ 0, < 0.2.19: Affected (semver)

    Update to 0.2.19

  • xhtml2pdf Debian:12

    Versions
    • 0.2.15+dfsg-1
    • 0.2.15+dfsg-2
    • 0.2.16+dfsg-1
    • 0.2.17+dfsg-1
    • 0.2.5-3
    • 0.2.5-4
    • 0.2.5-5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • xhtml2pdf Debian:13

    Versions
    • 0.2.17+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • xhtml2pdf Debian:14

    Versions
    • 0.2.17+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • xhtml2pdf Ubuntu:18.04:LTS

    Versions
    • 0.2b-1
    • 0.2b-2
    • 0.2.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • xhtml2pdf Ubuntu:20.04:LTS

    Versions
    • 0.2.2-3
    • 0.2.2-3build1
    • 0.2.2-5
    • 0.2.4-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • xhtml2pdf Ubuntu:22.04:LTS

    Versions
    • 0.2.4-1
    • 0.2.4-1ubuntu1
    • 0.2.5-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • xhtml2pdf Ubuntu:24.04:LTS

    Versions
    • 0.2.5-3
    • 0.2.5-5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • xhtml2pdf Ubuntu:26.10

    Versions
    • 0.2.17+dfsg-1ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • xhtml2pdf Ubuntu:26.04:LTS

    Versions
    • 0.2.17+dfsg-1ubuntu1
    • 0.2.17+dfsg-1ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →