Executive brief
node-qpdf is a Node.js library that wraps PDF encryption functionality. The encrypt() method fails to properly sanitize user-supplied file paths, allowing attackers to inject arbitrary shell commands that execute on the server. An attacker who controls the input PDF file path can execute arbitrary code with the privileges of the Node.js process.
Technical details
The vulnerability is a command injection flaw (CWE-77/CWE-94) in the node-qpdf encrypt() method. The root cause is insufficient input sanitization of the file path parameter, which is later passed to a system command execution API without proper escaping or validation. An attacker can inject shell metacharacters (e.g., `||`, `&&`, `;`) into the PDF file path to execute arbitrary commands. No authentication is required—any code that calls encrypt() with attacker-controlled input is vulnerable. The impact allows remote code execution with the privileges of the Node.js application. All versions up to and including 1.0.3 are affected; patch status is unknown from the advisory text.
Affected products
- node-qpdf node-qpdf All versions up to and including 1.0.3
Timeline
- 2023-06-08: disclosed: Vulnerability reported to GitHub issues
- 2023-10-14: advisory: GHSA-fpr8-4wvx-j9q3 published
- 2023-10-14: other: CVE-2023-26155 assigned