MITHALDU PDF::WebKit

• CVE-2026-17431 Medium 6.1 PDF::WebKit versions through 1.2 for Perl allow OS command injection via a 2-arg open() of the output path in to_pdf and of stylesheet paths in _style_tag_for 0.9%
• CVE-2026-16770 Critical 9.8 PDF::WebKit versions through 1.2 for Perl allow argument injection into wkhtmltopdf via meta tags in the source document 0.7%