Threats affecting pkg:github/grobidorg/grobid

GROBID versions prior to 0.9.1 contain an OS command injection vulnerability in the Linux non-server PDF conversion path. An attacker can craft a malicious PDF filename containing a single quote to break out of the intended command quoting, leading to arbitrary command execution with the privileges of the GROBID process. The REST server path is not affected. This vulnerability is fixed in version 0.9.1.

GROBID versions prior to 0.9.1 contain an uncontrolled resource consumption vulnerability in the unauthenticated /api/modelTraining endpoint. Each request to this endpoint creates a new fixed thread pool executor that remains running, leading to permanent retention of JVM worker threads. Repeated exploitation can exhaust system thread capacity, causing degradation or stoppage of request processing. This issue is fixed in version 0.9.1.