This vulnerability affects the argument injection handler in the node-poppler component of Fdawgs, specifically in functions such as pdfInfo, pdfToText, pdfToCairo, pdfToPpm, pdfImages, pdfToHtml, pdfToPs, pdfFonts, pdfDetach, pdfAttach, pdfSeparate, and pdfUnite within src/index.js. Manipulating the file_path argument allows an attacker to perform argument injection remotely. The affected versions are exactly 9.1.0, 9.1.1, 9.1.2, 10.0.0, and 10.0.1. A patch exists (commit db6e3f79d3beb20601be7e59669c39811ae3c330), but no explicit vendor advisory or remediation level is provided.

The vulnerability allows remote attackers to perform argument injection by manipulating the file_path argument in various PDF processing functions. This could potentially lead to unintended command execution or other injection-related impacts. The CVSS 4.0 base score is 6.9 (medium severity), indicating a moderate impact with network attack vector, low complexity, no privileges or user interaction required, and low to limited confidentiality, integrity, and availability impacts.

A patch identified by commit db6e3f79d3beb20601be7e59669c39811ae3c330 is recommended to fix this vulnerability. Since no official remediation level or vendor advisory is provided, users should apply this patch promptly to mitigate the risk. Patch status is not yet confirmed by a vendor advisory; check the vendor's official channels for updated remediation guidance.