CVE-2026-110642
xhtml2pdf before 0.2.19 OS Command Injection via startViewer File Name
xhtml2pdf xhtml2pdf
CVSS
8.5HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)1.15%Chance of exploitation activity in the next 30 days, higher than 66% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 0.2.19xhtml2pdfCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer() that allows attackers to execute commands by interpolating unescaped file names into os.system. Attackers can supply an input file whose name contains a double quote and shell metacharacters, which runs OS commands as the invoking user when the pisa tool is used with -s/--start-viewer.
Text from CVE List
Affected versions 1
- xhtml2pdfaffected: all versions before 0.2.19CVE List
References 5
- github.com/xhtml2pdf/xhtml2pdf/pull/835Fixvia CVE List
- github.com/xhtml2pdf/xhtml2pdf/commit/f86380dad15b3a6810201d08755a3ee6b19d5063Fixvia CVE List
- github.com/xhtml2pdf/xhtml2pdf/releases/tag/v0.2.19Fixvia CVE List
- vulncheck.com/advisories/xhtml2pdf-before-0.2.19-os-command-injection-via-startviewer-file-nameAdvisoryvia CVE List
- github.com/xhtml2pdf/xhtml2pdf/blob/v0.2.18/xhtml2pdf/pisa.py#L393-L400Referencevia CVE List