https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 22:53:27 +0000 https://cve.radiocsirt.org/vuln/cve-2026-16770 <p><strong>Affected:</strong> MITHALDU PDF::WebKit</p> <p>PDF::WebKit versions through 1.2 for Perl allow argument injection into wkhtmltopdf via meta tags in the source document.</p> <p>For an HTML string or file source, the constructor collects every &lt;meta name=&#34;pdf-webkit-KEY&#34; content=&#34;VALUE&#34;&gt; element in the document head through _pdf_webkit_meta_tags and turns each one into a wkhtmltopdf command line option. KEY is normalized to an option name matching --[a-z0-9-]+ but is not checked against an allow list, VALUE is passed through unchanged as the argument that follows it, and a VALUE of &#34;yes&#34; emits the option as a bare flag. BUILD merges the meta derived options last, so they also override the module defaults and the options passed to new. Switches such as --enable-local-file-access and --cookie-jar are reachable this way. The renderer is executed with an argument list rather than a shell command, so this is argument injection and not shell injection.</p> <p>Any caller that renders untrusted HTML lets the document choose the renderer&#39;s options and override those set by the application, including options that read local files into the resulting PDF or write to a chosen path. A URL source is not scanned, and the scan is skipped when XML::LibXML, a recommended dependency, is not installed.</p> <p><strong>Affected:</strong> MITHALDU PDF::WebKit</p> <p>PDF::WebKit versions through 1.2 for Perl allow argument injection into wkhtmltopdf via meta tags in the source document.</p> <p>For an HTML string or file source, the constructor collects every &lt;meta name=&#34;pdf-webkit-KEY&#34; content=&#34;VALUE&#34;&gt; element in the document head through _pdf_webkit_meta_tags and turns each one into a wkhtmltopdf command line option. KEY is normalized to an option name matching --[a-z0-9-]+ but is not checked against an allow list, VALUE is passed through unchanged as the argument that follows it, and a VALUE of &#34;yes&#34; emits the option as a bare flag. BUILD merges the meta derived options last, so they also override the module defaults and the options passed to new. Switches such as --enable-local-file-access and --cookie-jar are reachable this way. The renderer is executed with an argument list rather than a shell command, so this is argument injection and not shell injection.</p> <p>Any caller that renders untrusted HTML lets the document choose the renderer&#39;s options and override those set by the application, including options that read local files into the resulting PDF or write to a chosen path. A URL source is not scanned, and the scan is skipped when XML::LibXML, a recommended dependency, is not installed.</p> https://cve.radiocsirt.org/vuln/cve-2026-16770