CVE-2026-78637

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-78637
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-78637.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-78637
Published
2026-08-25T04:45:11.359Z
Modified
2026-08-28T11:47:33.198947663Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X CVSS Calculator
Summary
Fdawgs node-poppler Argument Injection index.js pdfUnite argument injection
Details

A vulnerability was detected in Fdawgs node-poppler up to 9.1.2/10.0.1. The impacted element is the function pdfInfo/pdfToText/pdfToCairo/pdfToPpm/pdfImages/pdfToHtml/pdfToPs/pdfFonts/pdfDetach/pdfAttach/pdfSeparate/pdfUnite of the file src/index.js of the component Argument Injection Handler. Performing a manipulation of the argument file_path results in argument injection. The attack may be initiated remotely. The patch is named db6e3f79d3beb20601be7e59669c39811ae3c330. It is recommended to apply a patch to fix this issue.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/78xxx/CVE-2026-78637.json",
    "cwe_ids": [
        "CWE-74",
        "CWE-88"
    ],
    "cna_assigner": "VulDB"
}
References

Affected packages

Git / github.com/fdawgs/node-poppler

Affected ranges

Type
GIT
Repo
https://github.com/fdawgs/node-poppler
Events
Introduced
0c2705278a8d2c84140d2eb8fe9119e065650f4d
Fixed
db6e3f79d3beb20601be7e59669c39811ae3c330
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "9.1.0"
        },
        {
            "last_affected": "9.1.0"
        },
        {
            "introduced": "9.1.1"
        },
        {
            "last_affected": "9.1.1"
        },
        {
            "introduced": "9.1.2"
        },
        {
            "last_affected": "9.1.2"
        },
        {
            "introduced": "10.0.0"
        },
        {
            "last_affected": "10.0.0"
        },
        {
            "introduced": "10.0.1"
        },
        {
            "last_affected": "10.0.1"
        }
    ]
}

Affected versions

10.*
10.0.0
10.0.1
9.*
9.1.0
9.1.1
9.1.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-78637.json"