Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-10-14T14:17:12 xhtml2pdf: xhtml2pdf: Arbitrary command execution via crafted file names 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CWE-78

xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer() that allows attackers to execute commands by interpolating unescaped file names into os.system. Attackers can supply an input file whose name contains a double quote and shell metacharacters, which runs OS commands as the invoking user when the pisa tool is used with -s/--start-viewer.

A flaw was found in xhtml2pdf. This vulnerability allows an attacker to execute arbitrary commands by convincing a user to process a file with a specially crafted name while using the viewer option. Because the software fails to properly sanitize the file name before passing it to the operating system, the injected commands run with the permissions of the user executing the tool.

An OS command injection flaw of IMPORTANT impact was found in xhtml2pdf, which Red Hat Quay products and services ship as a bundled dependency. The pisa.startViewer() function interpolates the input file name, without sanitization or escaping, into an os.system() call. When a user runs the pisa command-line tool with the -s/--start-viewer option on an input file whose name contains shell metacharacters (such as a double quote), an attacker can cause arbitrary operating system commands to be executed with the permissions of the invoking user. Exploitation requires local access and user interaction, because the victim must be convinced to process a file with a specially crafted name while using the viewer option; Red Hat rates this flaw as IMPORTANT (CVSS:3.1 7.8, AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), consistent with the upstream severity assessment. The affected Red Hat Quay container images and Quay service components are marked AFFECTED with a DELEGATED resolution, meaning the Quay business unit is pursuing a fix for the bundled xhtml2pdf package. The vulnerable code path is only reached when the pisa tool is invoked with the -s/--start-viewer option. As a workaround, avoid using the start-viewer option and process only files with trusted file names until a release containing the upstream fix is deployed. Red Hat Quay 3 Affected quay/quay-rhel8 Red Hat Quay 3 Affected quay/quay-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-110642 https://nvd.nist.gov/vuln/detail/CVE-2026-110642 https://github.com/xhtml2pdf/xhtml2pdf/blob/v0.2.18/xhtml2pdf/pisa.py#L393-L400 https://github.com/xhtml2pdf/xhtml2pdf/commit/f86380dad15b3a6810201d08755a3ee6b19d5063 https://github.com/xhtml2pdf/xhtml2pdf/pull/835 https://github.com/xhtml2pdf/xhtml2pdf/releases/tag/v0.2.19 https://www.vulncheck.com/advisories/xhtml2pdf-before-0.2.19-os-command-injection-via-startviewer-file-name