Vulnerability · Published Jul 25, 2026 · Assigned by CPANSec
CVE-2026-16766Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render options
Critical 9.8
In plain English
A critical-severity OS command injection in Catalyst::View::Wkhtmltopdf from RRWO. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.6% (higher than 85% of all known vulnerabilities).
Official description
Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render options. Options are passed directly to the wkhtmltopdf command without sanitization. Any web application that passes user-controlled options such as the page_size, orientation or margins without validation allows shell command injection. Version 0.6.0 was released with an incomplete fix for this issue. Note that the wkhtmltopdf project is no longer being developed, and users of this package should migrate to alternative solutions.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| RRWO | Catalyst::View::Wkhtmltopdf | 0 – before 0.6.1 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/robrwo/Catalyst-View-Wkhtmltopdf/security/advisories/GHSA-42w4-jj8w-6p98 vendor-advisory
- https://metacpan.org/release/RRWO/Catalyst-View-Wkhtmltopdf-v0.6.1/changes release-notes
- https://github.com/mc7244/Catalyst-View-Wkhtmltopdf/issues/6 issue-tracking
- https://wkhtmltopdf.org/status.html
- http://www.openwall.com/lists/oss-security/2026/07/25/4