CVE-2026-110636

Summary

The pypdftk library contains a critical OS command injection vulnerability that allows attackers to execute arbitrary shell commands with the privileges of the Python process. This occurs when user-supplied file paths are directly incorporated into shell commands without proper sanitization.

Exploitability

Exploitation is straightforward for attackers who can control pdf_path or out_file parameters, requiring only a single vulnerable function call with malicious input that includes shell metacharacters.

Blast radius

The vulnerability could affect any application using pypdftk to process PDF forms, potentially allowing attackers to execute arbitrary commands on the server with the same privileges as the Python process, leading to full system compromise.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 0.6 or later to address the OS command injection vulnerability in fill_form(), dump_data_fields(), and pdftk_cmd_util() functions.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.