CVE-2026-17431

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-17431

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-17431.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-17431

Published

2026-08-12T23:12:57.958Z

Modified

2026-08-15T11:31:09.353533075Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N CVSS Calculator

Summary

PDF::WebKit versions through 1.2 for Perl allow OS command injection via a 2-arg open() of the output path in to_pdf and of stylesheet paths in _style_tag_for

Details

PDF::WebKit versions through 1.2 for Perl allow OS command injection via a 2-arg open() of the output path in topdf and of stylesheet paths in styletagfor.

topdf reads the generated PDF back from its path argument, and styletagfor reads each entry of the stylesheets list, by assigning the path to a local @ARGV and reading it with the diamond operator, which opens each @ARGV element with Perl's 2-arg open(). A value that begins or ends with a pipe ("| cmd", "cmd |") is run as a command rather than opened as a file, and one that begins with a redirect ("> path", ">> path") opens that path for write or append. tofile forwards its path argument to topdf and reaches the same read.

Any caller that forwards untrusted input as the output path or as a stylesheets entry can run a command under the process UID; with the "cmd |" form the command's output is returned in place of the PDF, and with the "> path" form the named file is truncated. Stylesheets may only be added to an HTML source, so a URL or file source exposes the output path alone.

Database specific

{
    "cna_assigner": "CPANSec",
    "cwe_ids": [
        "CWE-73",
        "CWE-78"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/17xxx/CVE-2026-17431.json"
}

References

Affected packages

Git / github.com/kingpong/perl-pdf-webkit

Affected ranges

Type

GIT

Repo

https://github.com/kingpong/perl-pdf-webkit

Events

Introduced

Fixed

23ccc37d77604403c42dfba201d38b7366275955

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.2"
        },
        {
            "fixed": "1.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

v0.*

v0.10

v0.91

v1.*

v1.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-17431.json"