CVE-2026-17431: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in MITHALDU PDF::WebKit
PDF::WebKit versions through 1.2 for Perl allow OS command injection via a 2-arg open() of the output path in to_pdf and of stylesheet paths in _style_tag_for. to_pdf reads the generated PDF back from its path argument, and _style_tag_for reads each entry of the stylesheets list, by assigning the path to a local @ARGV and reading it with the diamond operator, which opens each @ARGV element with Perl's 2-arg open(). A value that begins or ends with a pipe ("| cmd", "cmd |") is run as a command rather than opened as a file, and one that begins with a redirect ("> path", ">> path") opens that path for write or append. to_file forwards its path argument to to_pdf and reaches the same read. Any caller that forwards untrusted input as the output path or as a stylesheets entry can run a command under the process UID; with the "cmd |" form the command's output is returned in place of the PDF, and with the "> path" form the named file is truncated. Stylesheets may only be added to an HTML source, so a URL or file source exposes the output path alone.
AI Analysis
Technical Summary
The vulnerability in PDF::WebKit (<=1.2) arises from improper neutralization of special elements in OS commands (CWE-78). The to_pdf function reads the generated PDF from a path argument, and _style_tag_for reads stylesheet paths by assigning them to @ARGV and opening them with Perl's 2-arg open(). If an attacker controls these paths and includes pipe or redirect characters, the open() call executes arbitrary OS commands instead of opening files. This can lead to command execution under the process UID, with potential to read command output or truncate files. Stylesheets can only be added to HTML sources, so only the output path is exposed in that context.
Potential Impact
An attacker who can supply untrusted input to the output path or stylesheet paths can execute arbitrary OS commands with the privileges of the running process. This can lead to unauthorized command execution, data disclosure, or file modification/truncation on the host system.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid passing untrusted input to the output path or stylesheet parameters in PDF::WebKit. Restrict usage to trusted inputs only to prevent command injection.
CVE-2026-17431: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in MITHALDU PDF::WebKit
Description
PDF::WebKit versions through 1.2 for Perl allow OS command injection via a 2-arg open() of the output path in to_pdf and of stylesheet paths in _style_tag_for. to_pdf reads the generated PDF back from its path argument, and _style_tag_for reads each entry of the stylesheets list, by assigning the path to a local @ARGV and reading it with the diamond operator, which opens each @ARGV element with Perl's 2-arg open(). A value that begins or ends with a pipe ("| cmd", "cmd |") is run as a command rather than opened as a file, and one that begins with a redirect ("> path", ">> path") opens that path for write or append. to_file forwards its path argument to to_pdf and reaches the same read. Any caller that forwards untrusted input as the output path or as a stylesheets entry can run a command under the process UID; with the "cmd |" form the command's output is returned in place of the PDF, and with the "> path" form the named file is truncated. Stylesheets may only be added to an HTML source, so a URL or file source exposes the output path alone.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in PDF::WebKit (<=1.2) arises from improper neutralization of special elements in OS commands (CWE-78). The to_pdf function reads the generated PDF from a path argument, and _style_tag_for reads stylesheet paths by assigning them to @ARGV and opening them with Perl's 2-arg open(). If an attacker controls these paths and includes pipe or redirect characters, the open() call executes arbitrary OS commands instead of opening files. This can lead to command execution under the process UID, with potential to read command output or truncate files. Stylesheets can only be added to HTML sources, so only the output path is exposed in that context.
Potential Impact
An attacker who can supply untrusted input to the output path or stylesheet paths can execute arbitrary OS commands with the privileges of the running process. This can lead to unauthorized command execution, data disclosure, or file modification/truncation on the host system.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid passing untrusted input to the output path or stylesheet parameters in PDF::WebKit. Restrict usage to trusted inputs only to prevent command injection.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- CPANSec
- Date Reserved
- 2026-07-25T08:39:34.495Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a7d0145bf8831d539509f6f
Added to database: 08/12/2026, 23:27:01 UTC
Last enriched: 08/12/2026, 23:45:11 UTC
Last updated: 08/13/2026, 01:40:43 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.