Executive brief
The PDF Export Module used in DHTMLX Gantt and Scheduler products contains a critical security flaw that allows remote attackers to execute arbitrary code on the server. This module is responsible for converting project management charts and schedules into PDF or PNG documents. An exploit could allow an unauthenticated attacker to take full control of the server, potentially leading to data theft, service disruption, or further network intrusion.
Technical details
A Remote Code Execution (RCE) vulnerability exists in the DHTMLX PDF Export Module (versions 0.3.3 through 0.7.5) due to improper neutralization of special elements used in an OS command (CWE-78). The vulnerability resides in the 'data' parameter, which is processed by a Node.js environment without adequate sanitization. An unauthenticated remote attacker can inject malicious JavaScript code into this parameter, which is subsequently executed by the server. This allows for full system compromise. The issue was addressed in version 0.7.6 by improving HTML content sanitization and fixing the underlying command injection vector.
Affected products
- DHTMLX PDF Export Module 0.3.3 - 0.7.5
- DHTMLX Gantt
- DHTMLX Scheduler
Timeline
- 2026-05-15: advisory: Published by CERT Polska and NVD
- 2026-05-15: patched: Fixed in version 0.7.6