CVE-2026-110642 in xhtml2pdf
Summary
by MITRE • 10/15/2026
xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer() that allows attackers to execute commands by interpolating unescaped file names into os.system. Attackers can supply an input file whose name contains a double quote and shell metacharacters, which runs OS commands as the invoking user when the pisa tool is used with -s/--start-viewer.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in xhtml2pdf prior to version 0.2.19 represents a critical security flaw rooted in improper neutralization of special elements used in an operating system command, commonly classified under CWE-78 as OS Command Injection. This specific weakness manifests within the pisa.startViewer() function, which is designed to launch a web browser or PDF viewer after rendering documents. The core technical failure lies in how this function handles file paths provided by the user. When the tool is invoked with the -s or --start-viewer flag, it attempts to open the generated output file directly using the operating system's command interpreter via os.system(). However, the implementation fails to properly sanitize or escape special characters within the filename before passing it to the shell. This lack of input validation allows an attacker who controls the name of the input source file to inject arbitrary commands into the execution context.
From a technical perspective, the exploitation vector relies on the interpolation of unescaped filenames directly into system calls. If an attacker supplies an input file with a name containing double quotes and standard shell metacharacters such as semicolons or ampersands, these characters are interpreted by the underlying operating system's command interpreter rather than being treated as literal parts of the filename. For instance, if the filename is crafted to include sequences like "; rm -rf /", the resulting command executed by os.system() will not just attempt to open a file with that name but will instead execute the injected commands sequentially after attempting to open the non-existent or misinterpreted file path. This behavior effectively bypasses any intended sandboxing or isolation, granting the attacker the ability to run arbitrary code on the host system.
The operational impact of this vulnerability is severe, particularly in environments where xhtml2pdf is used as part of an automated pipeline or a web application that processes user-uploaded files. Since the commands are executed with the privileges of the invoking user, successful exploitation can lead to full system compromise if the service runs with elevated permissions. An attacker could potentially read sensitive configuration files, exfiltrate data from the local filesystem, install malware, or use the compromised machine as a pivot point for further network attacks. The risk is amplified in shared hosting environments or CI/CD pipelines where multiple users or processes might share the same execution context, allowing lateral movement across systems based on the permissions of the vulnerable process.
This vulnerability aligns with MITRE ATT&CK technique T1059, specifically Command and Scripting Interpreter: Unix Shell, as it involves leveraging shell metacharacters to execute commands within a constrained environment. It also reflects CWE-78 due to the direct injection into OS commands without proper encoding or escaping of special characters. To mitigate this risk, organizations must upgrade xhtml2pdf to version 0.2.19 or later, where the issue has been addressed by properly sanitizing file paths before they are passed to system calls. In cases where upgrading is not immediately feasible, defensive measures should include restricting the execution environment using least privilege principles, ensuring that services running with this tool operate under restricted user accounts with minimal filesystem access rights. Additionally, implementing strict input validation on filenames and avoiding the use of shell=True or os.system() for launching external processes in favor of subprocess.run() with explicit argument lists can prevent similar injection vectors from being exploited.