Enviar #886399: Frazer Smith node-poppler (npm; GitHub org Fdawgs) <=9.1.2 Argument Injection

A vulnerability was identified in Frazer Smith node-poppler (GitHub org Fdawgs) up to and including version 9.1.2 (latest release; unpatched, and unpatched at main HEAD). Affected are the file-accepting public methods of the exported Poppler class: pdfInfo, pdfToText, pdfToCairo, pdfToPpm, pdfImages, pdfToHtml, pdfToPs, pdfFonts, pdfDetach, pdfAttach, pdfSeparate and pdfUnite. The caller-supplied file path is appended directly to the argument vector passed to child_process.spawn (invoked with shell:false) to run the bundled poppler-utils binaries, without rejecting a leading '-' and without inserting a '--' end-of-options separator before the operand. A file value that begins with '-' is therefore parsed by the poppler-utils argument parser as a command-line switch instead of a filename. This constitutes argument/switch injection (CWE-88).

Impact is bounded to option injection (not code execution; spawn runs with shell:false and poppler-utils expose no exec/plugin flag): subversion of the intended operation (a crafted operand such as -v, -h or -listenc makes the tool print information and exit successfully without ever reading the intended file, misleading callers that treat a resolved promise as successful processing), option toggling on the underlying utility, and, where a second operand is also attacker-influenced, injection of two-token flags such as -opw <ownerPassword> (encrypted-PDF restriction handling). Exploitation requires a consuming application to forward an attacker-influenced, unsanitized path to a Poppler method.

Proof of concept (benign, local): new Poppler(...).pdfInfo('-listenc') resolves successfully with 'Available encodings are: ...' (the -listenc switch executed), whereas pdfInfo('normal_user_file.pdf') is treated as a filename and rejects with an I/O error; the only difference is the leading dash, proving the operand is parsed as a switch.

Suggested fix: reject file operands beginning with '-' in every file-accepting method, or normalize relative paths so they cannot start with '-'.

CVSS 3.1 vector: AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L (Base 5.6). CWE-88.

Public reference (coordinated disclosure): https://github.com/Fdawgs/node-poppler/issues/822
npm: https://www.npmjs.com/package/node-poppler
Researcher: Mykhailo Kholiev.

• Fuente: ⚠️ https://github.com/Fdawgs/node-poppler/issues/822
• Usuario: Anonymous User
• Sumisión: 2026-07-11 13:12 (hace 2 meses)
• Moderación: 2026-08-25 00:56 (1 month later)
• Estado: Aceptado
• Entrada de VulDB: 394864 [Fdawgs node-poppler hasta 9.1.2/10.0.1 Argument Injection src/index.js file_path escalada de privilegios]
• Puntos: 20