CVE-2026-78637 Argument Injection in Fdawgs node-poppler

CVE-2026-78637 is an argument injection vulnerability affecting Fdawgs node-poppler versions up to 9.1.2 and 10.0.1. The flaw exists within the Argument Injection Handler logic located in src/index.js, impacting multiple functions including pdfInfo, pdfToText, pdfToCairo, pdfToPpm, pdfImages, pdfToHtml, pdfToPs, pdfFonts, pdfDetach, pdfAttach, pdfSeparate, and pdfUnite. By manipulating the file_path argument provided to these functions, a remote attacker can influence the underlying system command execution. This vulnerability is critical for applications that pass user-supplied file paths to these node-poppler methods, as it enables the execution of arbitrary command-line flags. Defenders should prioritize updating to the patched version, as identified by commit hash db6e3f79d3beb20601be7e59669c39811ae3c330.

Impact

Successful exploitation allows for argument injection, which may result in unauthorized command execution or the modification of standard command behavior. This affects any application utilizing node-poppler to process user-provided file paths.

Recommendation

• Upgrade the node-poppler dependency to a version containing the patch referenced in commit db6e3f79d3beb20601be7e59669c39811ae3c330.
• Audit applications utilizing node-poppler to ensure that all inputs passed to file_path parameters are strictly validated against a whitelist of expected formats before being processed.
• Apply the patch for CVE-2026-78637 across all affected environments immediately.