CVE-2026-107802 in SumatraPDF
Summary
by MITRE • 10/09/2026
SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, src/SelectionTranslate.cpp embeds selected or pasted translation text in quoted Windows command lines using incomplete quote-only escaping. The affected BuildGrokTranslateCmdLineTemp(), BuildClaudeTranslateCmdLineTemp(), and BuildCodexTranslateCmdLineTemp() functions can allow attacker-controlled text to inject model, working-directory, approval, or sandbox-bypass flags when the corresponding agentic CLI backend is installed and used. No broader impact is claimed beyond the advisory-supported conditions. No fixed version is available as of this review.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability identified in SumatraPDF versions 3.6.1 and earlier represents a critical command injection flaw within its translation feature, specifically affecting the integration with external artificial intelligence backends such as Grok, Claude, and Codex. This security issue resides in the source file SelectionTranslate.cpp, where the application constructs Windows command lines to invoke these agentic CLI tools for translating selected text or pasted content. The core technical flaw is an incomplete quote-only escaping mechanism used when embedding user-controlled input into the command string. By relying solely on wrapping arguments in quotes without properly sanitizing internal special characters that hold significance within the Windows Command Prompt environment, such as ampersands, pipes, redirection operators, and parentheses, the application fails to isolate the intended argument from subsequent shell parsing logic. This design oversight allows an attacker who can influence the text being translated or pasted into SumatraPDF to break out of the quoted context and inject arbitrary command-line flags.
The operational impact of this vulnerability is significant because it enables privilege escalation within the scope of the application's execution environment, specifically targeting the configuration parameters of the AI backend services. An attacker could craft malicious input that includes sequences like ampersand followed by a space or other shell metacharacters to terminate the current argument and append new flags. These injected arguments can manipulate critical model selection, working directory paths, approval workflows, or sandbox bypass mechanisms depending on which specific translation function is triggered, such as BuildGrokTranslateCmdLineTemp(), BuildClaudeTranslateCmdLineTemp(), or BuildCodexTranslateCmdLineTemp(). If a user interacts with maliciously crafted text while an agentic CLI backend is installed and configured for use, the application will execute commands that deviate from the intended behavior. This could lead to unauthorized access to sensitive data stored in alternative working directories, execution of arbitrary code under the context of the current user through command chaining, or bypassing security controls implemented by the AI service itself, such as sandbox restrictions designed to limit model capabilities.
From a classification perspective, this vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection. The failure to properly sanitize user input before its inclusion in a system command allows for the injection of additional commands or arguments that alter the execution flow. Furthermore, this technique maps directly to MITRE ATT&CK tactic T1059 Command and Scripting Interpreter, specifically sub-techniques involving Windows CMD shell interactions such as argument splitting (T1059.004) or command chaining via special characters like ampersands and semicolons. The vulnerability exploits the parser's behavior in interpreting quoted strings with embedded metacharacters that are not escaped, a common pitfall when constructing dynamic commands for external processes without using robust parameterization methods.
Mitigation strategies must address both immediate remediation and long-term architectural improvements since no fixed version is currently available as of this review. Users should immediately disable or uninstall any agentic CLI translation backends such as Grok, Claude, or Codex integrations within SumatraPDF until a patched release is issued. Administrators can also enforce application control policies to restrict the execution of command-line interpreters by third-party applications where possible, although this may impact legitimate functionality. For developers and future versions, the remediation requires replacing string concatenation with proper argument passing mechanisms that do not rely on shell parsing for security boundaries. This involves using APIs that accept arguments as distinct array elements rather than a single concatenated string, thereby ensuring that special characters within user input are treated strictly as data and never as executable syntax. Additionally, implementing strict allow-listing of expected inputs for translation text can further reduce the attack surface by rejecting any content containing shell metacharacters before they reach the command construction logic.