CVE-2026-107802

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-107802
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107802.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-107802
Aliases
  • GHSA-xvxg-cwmx-hr7j
Published
2026-10-08T22:36:36Z
Modified
2026-10-10T13:03:09Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
SumatraPDF — Windows command-line argument injection in AI selection-translate
Details

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, src/SelectionTranslate.cpp embeds selected or pasted translation text in quoted Windows command lines using incomplete quote-only escaping. The affected BuildGrokTranslateCmdLineTemp(), BuildClaudeTranslateCmdLineTemp(), and BuildCodexTranslateCmdLineTemp() functions can allow attacker-controlled text to inject model, working-directory, approval, or sandbox-bypass flags when the corresponding agentic CLI backend is installed and used. No broader impact is claimed beyond the advisory-supported conditions. No fixed version is available as of this review.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-88"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107802.json"
}
References

Affected packages

Git / github.com/sumatrapdfreader/sumatrapdf

Affected ranges

Type
GIT
Repo
https://github.com/sumatrapdfreader/sumatrapdf
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6b88a751ab34a28bafca3bdd635aaa2f4c1e06b6
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.6.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

1.*
1.4split
1.5split
1.6split
1.7split
1.8split
1.9split
2.*
2.0split
2.1split
2.2split
2.3split
2.4split
2.5split
3.*
3.0split
3.1.2rel
3.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107802.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "225413628470954640670305747786000222463",
            "length": 954
        },
        "id": "CVE-2026-107802-036282df",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/sumatrapdfreader/sumatrapdf/commit/6b88a751ab34a28bafca3bdd635aaa2f4c1e06b6",
        "target": {
            "file": "src/SelectionTranslate.cpp",
            "function": "BuildCodexTranslateCmdLineTemp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "22488041493375509533814027291946885264",
                "234946122957949372878643027814146057270",
                "47305640170015910024439354649997589637",
                "98169108744075861600388971716787752049",
                "152609346174182961891350649568279497950"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-107802-45f0eeef",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/sumatrapdfreader/sumatrapdf/commit/6b88a751ab34a28bafca3bdd635aaa2f4c1e06b6",
        "target": {
            "file": "src/AIChatPanel.cpp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "186577101831838927725060007185792784674",
            "length": 575
        },
        "id": "CVE-2026-107802-5fd105a9",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/sumatrapdfreader/sumatrapdf/commit/6b88a751ab34a28bafca3bdd635aaa2f4c1e06b6",
        "target": {
            "file": "src/base/CmdLineArgsIter.cpp",
            "function": "QuoteCmdLineArgTemp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "177210921663098307131550233424035746881",
                "153921972041205893751687217283967229506",
                "284576554730554872361303640484304727973",
                "244004052002139990330933519682058851756",
                "73505335136333774095810937633891545005",
                "331777786207400400435323855872051331465"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-107802-755ef99f",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/sumatrapdfreader/sumatrapdf/commit/6b88a751ab34a28bafca3bdd635aaa2f4c1e06b6",
        "target": {
            "file": "src/base/tests/Win_ut.cpp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "123247576157093242478143317104851641457",
            "length": 2787
        },
        "id": "CVE-2026-107802-82eb0101",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/sumatrapdfreader/sumatrapdf/commit/6b88a751ab34a28bafca3bdd635aaa2f4c1e06b6",
        "target": {
            "file": "src/AIChatPanel.cpp",
            "function": "SendAIChatMessage"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "160378244179925671988611778148000829356",
                "231772383515079265980376187519631876445",
                "48918610180661101602983411866067661342",
                "324368905035990161590522768641140819438",
                "176786732535283246765018339923792125168",
                "189911422127799130578328007642889428324",
                "297377883436136391832929810490810624869",
                "21478414917331766008353610830285823448",
                "251454336290607973830607580710233769557",
                "138908287615834241500672105679039002613",
                "30250711128714267056378287007162992324",
                "91709996116946703101207352416125879669",
                "295339409495136024764820321942754734797",
                "305576984799058937376292719316409611693"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-107802-947b7872",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/sumatrapdfreader/sumatrapdf/commit/6b88a751ab34a28bafca3bdd635aaa2f4c1e06b6",
        "target": {
            "file": "src/GrokBuild.cpp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "279354650990701232218532376846372450091",
            "length": 567
        },
        "id": "CVE-2026-107802-97497551",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/sumatrapdfreader/sumatrapdf/commit/6b88a751ab34a28bafca3bdd635aaa2f4c1e06b6",
        "target": {
            "file": "src/SelectionTranslate.cpp",
            "function": "BuildClaudeTranslateCmdLineTemp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "61823519105115673293889720232211594848",
                "30948275007579787618796279239309257728",
                "160326143762232975895993595325226884003",
                "108264968854522126804996358153147119073",
                "275187496393853162874919620454519672635",
                "334691730566078471084520870822046020648",
                "108095488694897547019883794466332701487",
                "234298162167958484348784868262561746090",
                "254280505868715439219570267115748650642",
                "87232192408088430938873344423172778508",
                "196514598884829859497017741558268268101",
                "16847338765725632539821005649698873760",
                "235979883550388847885788706341665436461",
                "198381833872166014971835531405636031763",
                "68655249083100943749135738733484358045",
                "141943048792139182489014410801758089009",
                "293241766352709624142035685260974318675",
                "197496727437578561790304682951553168356",
                "13854885124009547952649196782691644057",
                "271001356462887517846144780137450409280",
                "295867895506894464600919183519889155452",
                "40384204276759332442933752793257107875",
                "145777552382373439815167420859191560568",
                "150568543821659078129527121530973715129",
                "104718888379847733024072420988041981918",
                "89368693240350042097957670101190643068",
                "170076755196832621597995628615910542250",
                "222725577364190392643701952043155106716",
                "308194957543716507575456244762040947432"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-107802-a098675b",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/sumatrapdfreader/sumatrapdf/commit/6b88a751ab34a28bafca3bdd635aaa2f4c1e06b6",
        "target": {
            "file": "src/base/CmdLineArgsIter.cpp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "186431075096505300775806106514220612723",
                "244749995503180933483968685862768806905",
                "182986309614494485158473678353570595686",
                "6970810291832499691281818768378302011",
                "271201547709388555698401496584759756309",
                "219506812804648395322111725795393491617",
                "149762033091640539096616779860830450001",
                "6432915747757976937217542221121701747",
                "258641395594389377064202319395645104671",
                "289928573679240495759387989197093869583",
                "211609500832849449482713460362084109734",
                "208687724922850418312837147466256319054",
                "62965818121850614452483187111117067467",
                "304298369389763968307808008547105928992",
                "55942939814721989866999317480309508226",
                "314182300129891482970324035518088728663",
                "103060551868635231852967364665768091573",
                "230577630020857186464038071789232812830",
                "196181037394247097314982182615553219532",
                "131209323424963590167231029303031930584",
                "118524746965900129212087571577080825962",
                "90411931398629572974500600984705214577",
                "135528113523021179006056794130481828676",
                "71519698633328731058679472320732121013",
                "174202435551418862142974894643534719911",
                "186121905533276293625842412485613125345",
                "73778155243758139683630918262165379468",
                "284134909671278959568141959206377982716",
                "104366825282744190101176473740537110231",
                "212701162170231583403093403499996564897",
                "125030337577563798193090736302496599648",
                "238274926996084642205343759243268517328",
                "332473468285526066276726400666402732222",
                "337424283928946175991553198086205084059",
                "63825233913915540362489137445332000240"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-107802-b8a553e4",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/sumatrapdfreader/sumatrapdf/commit/6b88a751ab34a28bafca3bdd635aaa2f4c1e06b6",
        "target": {
            "file": "src/SelectionTranslate.cpp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "160378244179925671988611778148000829356",
                "148434819611045899477340784330776054817",
                "264509935566349525890900157989668612210",
                "219012159166803027873128411304290791270",
                "90899039763677380107610642270840648875",
                "191980167100306495378784735903137547572",
                "191630488926413888404051315360871598692",
                "238349833703349532833127126476320121155",
                "90966220368982230194189863623965677533",
                "93582294481425344295054631933009570769",
                "301889135110230818296681827977967152693",
                "263428586386038446404798776298274039623",
                "273124192681181794538517851196781310438",
                "115282327125129804037250593301382316845",
                "50342614819375961169383543206926004190",
                "219236666963645453099420455078120543824",
                "88245041347581500745382860880488831076"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-107802-c4ff2842",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/sumatrapdfreader/sumatrapdf/commit/6b88a751ab34a28bafca3bdd635aaa2f4c1e06b6",
        "target": {
            "file": "src/ClaudeCode.cpp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "254456131858141157466808886189227746025",
            "length": 539
        },
        "id": "CVE-2026-107802-cca31fc9",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/sumatrapdfreader/sumatrapdf/commit/6b88a751ab34a28bafca3bdd635aaa2f4c1e06b6",
        "target": {
            "file": "src/SelectionTranslate.cpp",
            "function": "BuildGrokTranslateCmdLineTemp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "160378244179925671988611778148000829356",
                "99976000960808001068936298090011669661",
                "242346021633334790668927867622636457866",
                "50079789835734765215632011135684157460",
                "337396057309321482293093740349339485127",
                "300344223124505001738305376530291384974",
                "92948788997383016927651989900136513501",
                "182969244661456255594611122854609795099",
                "14751164466513041836307375700891864472",
                "319152379587695526324131018774045842321",
                "70630878466205163394297909476979225325",
                "27391816873082301603989028877813289971",
                "282466714285013620600932333204263668453",
                "22699443353970261313568600849060453046",
                "99186668021986450003016754309896566806",
                "330277346732017549913486900393217362724",
                "34829508267695460108943389384205961303",
                "265131145208640173057946130386342691228",
                "84450430552672330325136560160941149475"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-107802-dc994158",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/sumatrapdfreader/sumatrapdf/commit/6b88a751ab34a28bafca3bdd635aaa2f4c1e06b6",
        "target": {
            "file": "src/CodexBuild.cpp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "77023578790289835323781364288801075871",
            "length": 1662
        },
        "id": "CVE-2026-107802-f68545ba",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/sumatrapdfreader/sumatrapdf/commit/6b88a751ab34a28bafca3bdd635aaa2f4c1e06b6",
        "target": {
            "file": "src/base/tests/Win_ut.cpp",
            "function": "WinUtilTest"
        }
    }
]
vanir_signatures_modified 
"2026-10-10T13:03:09Z"