| 제목 | Frazer Smith node-poppler (npm; GitHub org Fdawgs) <=9.1.2 Argument Injection |
|---|
| 설명 | A vulnerability was identified in Frazer Smith node-poppler (GitHub org Fdawgs) up to and including version 9.1.2 (latest release; unpatched, and unpatched at main HEAD). Affected are the file-accepting public methods of the exported Poppler class: pdfInfo, pdfToText, pdfToCairo, pdfToPpm, pdfImages, pdfToHtml, pdfToPs, pdfFonts, pdfDetach, pdfAttach, pdfSeparate and pdfUnite. The caller-supplied file path is appended directly to the argument vector passed to child_process.spawn (invoked with shell:false) to run the bundled poppler-utils binaries, without rejecting a leading '-' and without inserting a '--' end-of-options separator before the operand. A file value that begins with '-' is therefore parsed by the poppler-utils argument parser as a command-line switch instead of a filename. This constitutes argument/switch injection (CWE-88).
Impact is bounded to option injection (not code execution; spawn runs with shell:false and poppler-utils expose no exec/plugin flag): subversion of the intended operation (a crafted operand such as -v, -h or -listenc makes the tool print information and exit successfully without ever reading the intended file, misleading callers that treat a resolved promise as successful processing), option toggling on the underlying utility, and, where a second operand is also attacker-influenced, injection of two-token flags such as -opw <ownerPassword> (encrypted-PDF restriction handling). Exploitation requires a consuming application to forward an attacker-influenced, unsanitized path to a Poppler method.
Proof of concept (benign, local): new Poppler(...).pdfInfo('-listenc') resolves successfully with 'Available encodings are: ...' (the -listenc switch executed), whereas pdfInfo('normal_user_file.pdf') is treated as a filename and rejects with an I/O error; the only difference is the leading dash, proving the operand is parsed as a switch.
Suggested fix: reject file operands beginning with '-' in every file-accepting method, or normalize relative paths so they cannot start with '-'.
CVSS 3.1 vector: AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L (Base 5.6). CWE-88.
Public reference (coordinated disclosure): https://github.com/Fdawgs/node-poppler/issues/822
npm: https://www.npmjs.com/package/node-poppler
Researcher: Mykhailo Kholiev. |
|---|
| 원천 | ⚠️ https://github.com/Fdawgs/node-poppler/issues/822 |
|---|
| 사용자 | Anonymous User |
|---|
| 제출 | 2026. 07. 11. PM 01:12 (1 월 ago) |
|---|
| 모더레이션 | 2026. 08. 25. AM 12:56 (1 month later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 394864 [Fdawgs node-poppler 까지 9.1.2/10.0.1 Argument Injection src/index.js file_path 권한 상승] |
|---|
| 포인트들 | 20 |
|---|