CVE-2026-110636: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in revolunet pypdftk

CVE-2026-110636 describes an OS command injection vulnerability in the pypdftk Python library (versions up to 0.5). The vulnerability exists in the fill_form(), dump_data_fields(), and pdftk_cmd_util() functions, which construct shell commands using subprocess.Popen with shell=True. Because these functions use caller-supplied paths (pdf_path, out_file) without proper neutralization of special shell characters, an attacker can inject malicious commands that the OS will execute with the privileges of the Python process.

Successful exploitation allows unauthenticated attackers to execute arbitrary operating system commands remotely, potentially leading to full system compromise. The CVSS 4.0 score of 9.3 (critical) reflects the high impact and ease of exploitation without privileges or user interaction.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid passing untrusted input to the affected functions or sanitize inputs to prevent shell metacharacter injection.