Log in Start free

Vulnerability · Published Oct 14, 2026 · Assigned by VulnCheck

CVE-2026-110642xhtml2pdf before 0.2.19 OS Command Injection via startViewer File Name

High 7.8

In plain English

A high-severity OS command injection in xhtml2pdf from xhtml2pdf. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 67% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)1.1%top 33.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer() that allows attackers to execute commands by interpolating unescaped file names into os.system. Attackers can supply an input file whose name contains a double quote and shell metacharacters, which runs OS commands as the invoking user when the pisa tool is used with -s/--start-viewer.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12xhtml2pdfno fix listedDEBIAN-CVE-2026-110642
Debian:13xhtml2pdfno fix listedDEBIAN-CVE-2026-110642
Debian:14xhtml2pdfno fix listedDEBIAN-CVE-2026-110642
Ubuntu:22.04:LTSxhtml2pdfno fix listedUBUNTU-CVE-2026-110642
Ubuntu:24.04:LTSxhtml2pdfno fix listedUBUNTU-CVE-2026-110642
Ubuntu:26.04:LTSxhtml2pdfno fix listedUBUNTU-CVE-2026-110642
Ubuntu:26.10xhtml2pdfno fix listedUBUNTU-CVE-2026-110642

Affected products (as reported)

VendorProductVersions
xhtml2pdf xhtml2pdf 0 – before 0.2.19

Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References