Executive brief
MIMICLab mcp-pdf-vision is a PDF processing server that converts PDF files into images for document understanding. A command injection vulnerability in the PDF page extraction function allows a local attacker to execute arbitrary shell commands by manipulating file paths passed to the tool.
Technical details
The vulnerability is a command injection flaw in the load_pdf function (src/index.ts) where user-controlled pdfPath and sessionId parameters are interpolated directly into shell commands without proper escaping. The vulnerable code builds a pdftoppm command string using double-quoted variable substitution, which still allows command substitution via $() syntax. An MCP client can inject shell metacharacters in file paths to execute arbitrary commands via execAsync(). The attack requires local access to invoke the vulnerable MCP tools. No patch has been released, and the project maintainers have not responded to the initial issue report.
Affected products
- MIMICLab mcp-pdf-vision 1.1.0
Timeline
- 2026-04-29: disclosed: Vulnerability reported as GitHub issue #1
- 2026-08-08: advisory: CVE-2026-19279 published