Executive brief
pdf-image is a Node.js library that converts PDF pages to image files using system tools like ImageMagick and Ghostscript. The library is vulnerable to OS command injection when processing user-supplied file paths, allowing attackers to execute arbitrary system commands on the server hosting the application.
Technical details
The vulnerability is a classic OS command injection (CWE-78) in the constructGetInfoCommand and constructConvertCommandForPage functions, which use util.format() to interpolate unsanitized user-controlled pdfFilePath parameters directly into shell command strings executed via child_process.exec(). An unauthenticated attacker can supply a malicious file path containing shell metacharacters to achieve arbitrary command execution with the privileges of the Node.js process. The vulnerability affects all versions up to and including 2.0.0. No patch is currently available; users should avoid passing unsanitized user input to the pdfFilePath parameter or transition away from this archived library.
Affected products
- mooz pdf-image through 2.0.0
Timeline
- 2026-03-25: disclosed: Published to GitHub Advisory Database and NVD
- 2020-04-15: other: Repository archived on GitHub, marked read-only