cve/2023/CVE-2023-26155.md

### [CVE-2023-26155](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-26155)
![](https://img.shields.io/static/v1?label=Product&message=node-qpdf&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=0%3C%20*%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=Command%20Injection&color=brighgreen)

### Description

All versions of the package node-qpdf are vulnerable to Command Injection such that the package-exported method encrypt() fails to sanitize its parameter input, which later flows into a sensitive command execution API. As a result, attackers may inject malicious commands once they can specify the input pdf file path.

### POC

#### Reference
- https://github.com/nrhirani/node-qpdf/issues/23
- https://security.snyk.io/vuln/SNYK-JS-NODEQPDF-5747918

#### Github
No PoCs found on GitHub currently.