{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3apypdftk_projectpypdftkpython/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:pypdftk_project:pypdftk:*:*:*:*:*:python:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-110636"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["critical"],"_cs_tags":["command-injection","python","supply-chain"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe pypdftk library, in all versions up to and including 0.5, contains a critical OS command injection vulnerability. The flaw resides in the fill_form(), dump_data_fields(), and pdftk_cmd_util() functions, which improperly sanitize user-supplied file paths. When these functions are called, the library constructs shell commands containing the provided paths and passes them to Python's subprocess.Popen method with the shell=True argument enabled. This behavior allows an attacker who controls the input to the pdf_path or out_file parameters to inject arbitrary shell metacharacters. If successfully exploited, the attacker can execute system commands with the same privileges as the application process running the pypdftk library. This vulnerability poses a severe risk to any application that processes user-uploaded PDFs or dynamically generates PDF-related file paths using this library.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in arbitrary code execution on the host machine running the affected Python application. The impact is critical, as it grants attackers the ability to compromise the underlying system, exfiltrate sensitive data, or move laterally within the network. The vulnerability affects any environment utilizing pypdftk \u0026lt;= 0.5 for PDF manipulation, regardless of the underlying operating system.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately upgrade pypdftk to a version beyond 0.5 if a security update is available, or remove the library from the environment if no patch exists.\u003c/li\u003e\n\u003cli\u003eAudit all applications using pypdftk to identify if user-controlled input reaches the pdf_path or out_file arguments in the identified vulnerable functions.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation and sanitization for all file paths before they are passed to any third-party PDF manipulation libraries.\u003c/li\u003e\n\u003cli\u003eTransition to using subprocess.run or subprocess.Popen with shell=False, passing arguments as a list to prevent shell interpretation of metacharacters, even if the library itself remains vulnerable.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-14T16:33:13Z","date_published":"2026-10-14T16:33:13Z","id":"https://feed.craftedsignal.io/briefs/2026-10-pypdftk-command-injection/","summary":"The pypdftk library (\u003c= 0.5) is vulnerable to OS command injection via insecure path handling in its core functions, allowing arbitrary command execution when using subprocess.Popen.","title":"OS Command Injection in pypdftk","url":"https://feed.craftedsignal.io/briefs/2026-10-pypdftk-command-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:pypdftk_project:pypdftk:*:*:*:*:*:python:*:*","version":"https://jsonfeed.org/version/1.1"}