Threats affecting pkg:npm/exiftool-vendored.js

A high-severity vulnerability (CVE-2026-43893) exists in photostructure's exiftool-vendored.js prior to version 35.19.0. The issue involves improper neutralization of argument delimiters, allowing attacker-controlled input containing newline or carriage return characters to inject additional arguments into ExifTool commands. This can cause ExifTool to read or write files accessible to its process based on attacker input. No remote code execution has been demonstrated. The vulnerability is fixed in version 35.19.0.