What is GHSA-q5mh-72xg-628w?

GHSA-q5mh-72xg-628w is a security advisory published by GitHub Security Advisories with Critical severity. pdf-image has an OS Command Injection Vulnerability through its pdfFilePath parameter

Which CVE IDs does GHSA-q5mh-72xg-628w cover?

GHSA-q5mh-72xg-628w covers the following CVE IDs: CVE-2026-26830. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-q5mh-72xg-628w?

GHSA-q5mh-72xg-628w has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-q5mh-72xg-628w?

GHSA-q5mh-72xg-628w affects 1 product, including: npm/pdf-image:\u003c= 2.0.0.

GHSA-q5mh-72xg-628wCriticalCVSS 9.8

pdf-image has an OS Command Injection Vulnerability through its pdfFilePath parameter

Vendor

GitHub Security Advisories

Published

March 25, 2026

Last Modified

March 27, 2026

🔗 CVE IDs covered (1)

CVE-2026-26830 →

📋 Description

pdf-image (npm package) through version 2.0.0 allows OS command injection via the pdfFilePath parameter. The constructGetInfoCommand and constructConvertCommandForPage functions use util.format() to interpolate user-controlled file paths into shell command strings that are executed via child_process.exec().

🎯 Affected products1

npm/pdf-image:<= 2.0.0

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-26830
https://github.com/zebbernCVE/CVE-2026-26830
https://github.com/advisories/GHSA-q5mh-72xg-628w