| 标题 | Frazer Smith node-poppler (npm; GitHub org Fdawgs) <=9.1.2 Argument Injection |
|---|
| 描述 | A vulnerability was identified in Frazer Smith node-poppler (GitHub org Fdawgs) up to and including version 9.1.2 (latest release; unpatched, and unpatched at main HEAD). Affected are the file-accepting public methods of the exported Poppler class: pdfInfo, pdfToText, pdfToCairo, pdfToPpm, pdfImages, pdfToHtml, pdfToPs, pdfFonts, pdfDetach, pdfAttach, pdfSeparate and pdfUnite. The caller-supplied file path is appended directly to the argument vector passed to child_process.spawn (invoked with shell:false) to run the bundled poppler-utils binaries, without rejecting a leading '-' and without inserting a '--' end-of-options separator before the operand. A file value that begins with '-' is therefore parsed by the poppler-utils argument parser as a command-line switch instead of a filename. This constitutes argument/switch injection (CWE-88).
Impact is bounded to option injection (not code execution; spawn runs with shell:false and poppler-utils expose no exec/plugin flag): subversion of the intended operation (a crafted operand such as -v, -h or -listenc makes the tool print information and exit successfully without ever reading the intended file, misleading callers that treat a resolved promise as successful processing), option toggling on the underlying utility, and, where a second operand is also attacker-influenced, injection of two-token flags such as -opw <ownerPassword> (encrypted-PDF restriction handling). Exploitation requires a consuming application to forward an attacker-influenced, unsanitized path to a Poppler method.
Proof of concept (benign, local): new Poppler(...).pdfInfo('-listenc') resolves successfully with 'Available encodings are: ...' (the -listenc switch executed), whereas pdfInfo('normal_user_file.pdf') is treated as a filename and rejects with an I/O error; the only difference is the leading dash, proving the operand is parsed as a switch.
Suggested fix: reject file operands beginning with '-' in every file-accepting method, or normalize relative paths so they cannot start with '-'.
CVSS 3.1 vector: AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L (Base 5.6). CWE-88.
Public reference (coordinated disclosure): https://github.com/Fdawgs/node-poppler/issues/822
npm: https://www.npmjs.com/package/node-poppler
Researcher: Mykhailo Kholiev. |
|---|
| 来源 | ⚠️ https://github.com/Fdawgs/node-poppler/issues/822 |
|---|
| 用户 | Anonymous User |
|---|
| 提交 | 2026-07-11 13時12分 (1 月前) |
|---|
| 管理 | 2026-08-25 00時56分 (1 month later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 394864 [Fdawgs node-poppler 直到 9.1.2/10.0.1 Argument Injection src/index.js file_path 权限提升] |
|---|
| 积分 | 20 |
|---|