CVE-2026-110642
Description
A flaw was found in xhtml2pdf. This vulnerability allows an attacker to execute arbitrary commands by convincing a user to process a file with a specially crafted name while using the viewer option. Because the software fails to properly sanitize the file name before passing it to the operating system, the injected commands run with the permissions of the user executing the tool.
Statement
An OS command injection flaw of IMPORTANT impact was found in xhtml2pdf, which Red Hat Quay products and services ship as a bundled dependency. The pisa.startViewer() function interpolates the input file name, without sanitization or escaping, into an os.system() call. When a user runs the pisa command-line tool with the -s/--start-viewer option on an input file whose name contains shell metacharacters (such as a double quote), an attacker can cause arbitrary operating system commands to be executed with the permissions of the invoking user. Exploitation requires local access and user interaction, because the victim must be convinced to process a file with a specially crafted name while using the viewer option; Red Hat rates this flaw as IMPORTANT (CVSS:3.1 7.8, AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), consistent with the upstream severity assessment. The affected Red Hat Quay container images and Quay service components are marked AFFECTED with a DELEGATED resolution, meaning the Quay business unit is pursuing a fix for the bundled xhtml2pdf package.
Mitigation
The vulnerable code path is only reached when the pisa tool is invoked with the -s/--start-viewer option. As a workaround, avoid using the start-viewer option and process only files with trusted file names until a release containing the upstream fix is deployed.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.8 | N/A | 7.8 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability,Non-Repudiation
Technical Impact: Execute Unauthorized Code or Commands; DoS: Crash, Exit, or Restart; Read Files or Directories; Modify Files or Directories; Read Application Data; Modify Application Data; Hide Activities
Attackers could execute unauthorized operating system commands, which could then be used to disable the product, or read and modify data for which the attacker does not have permissions to access directly. Since the targeted application is directly executing the commands instead of the attacker, any malicious activities may appear to come from the application or the application's owner.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
