Executive brief
Openlabs docker-wkhtmltopdf-aas is a web service used to convert HTML documents into PDF files. A security vulnerability in this service allows an attacker to send a specially crafted request that executes unauthorized commands on the underlying server. This could lead to a complete takeover of the containerized environment, potentially exposing sensitive data or allowing the attacker to launch further attacks on the internal network.
Technical details
An OS command injection vulnerability exists in the `app.py` component of the `docker-wkhtmltopdf-aas` project. The vulnerability stems from the insecure handling of user-supplied keys and values within the 'options' dictionary of a POST request. Specifically, the application iterates through these options and appends them to a list that is subsequently joined into a single string and executed via a shell-like interface using the `executor` module. Because the input is not properly sanitized or escaped before being passed to the shell, a remote, unauthenticated attacker can inject arbitrary shell commands. This can be achieved by including shell metacharacters in either the option names or their associated values in a JSON or form-encoded payload. The repository was archived in June 2026 and may not receive official patches.
Affected products
- Openlabs docker-wkhtmltopdf-aas up to commit 9f50579
Timeline
- 2026-06-01: other: Repository archived by owner
- 2026-06-03: disclosed: CVE published to NVD