Executive brief
pdf-image is a Node.js library that converts PDF files to images. Due to insufficient input validation on PDF file paths, an attacker can inject arbitrary code if the file path is constructed from untrusted user input, leading to remote code execution on the server running the application.
Technical details
The pdf-image npm package (versions ≤ 2.0.0) lacks proper input validation on PDF file paths, enabling code injection attacks (CWE-20: Improper Input Validation, CWE-94: Improper Control of Generation of Code). An attacker can craft a malicious PDF file path using untrusted user input to achieve arbitrary code execution on the target system. The vulnerability requires the application to construct file paths based on user-controlled data without sanitization. No authentication or complex interaction is needed; the attack is network-accessible if the application exposes PDF conversion functionality. Patches are available in versions after 2.0.0.
Affected products
- pdf-image pdf-image ≤ 2.0.0
Timeline
- 2020-02-28: disclosed
- 2021-05-10: advisory