The exiftool-vendored.js library, used for Node.js access to ExifTool, previously started ExifTool with arguments read from stdin line-by-line. In versions before 35.19.0, user-supplied strings were interpolated into ExifTool arguments without filtering out line delimiters such as newline or carriage return characters. This allowed an attacker to inject additional arguments by splitting a single intended argument into multiple ones. The vulnerability also involved unsafe NUL bytes, which are now rejected. Exploitation could lead to ExifTool reading files accessible to its process or writing output to attacker-chosen filesystem paths. No remote code execution has been demonstrated. The vulnerability is addressed by rejecting unsafe characters and properly sanitizing input in version 35.19.0.

An attacker who can supply input to the affected APIs may cause ExifTool to process unintended files or write output to arbitrary filesystem locations accessible by the ExifTool process. This can lead to unauthorized disclosure of file contents or manipulation of files. However, no remote code execution or system-level compromise has been demonstrated. There are no known exploits in the wild at this time.

Upgrade exiftool-vendored.js to version 35.19.0 or later, where this vulnerability is fixed by rejecting unsafe control characters and properly sanitizing input arguments. Until upgraded, avoid passing untrusted or attacker-controlled strings to the affected APIs. Patch status is not explicitly stated beyond the fixed version; therefore, confirm with the vendor advisory for any additional remediation guidance.