PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-78637 Fdawgs CVE debrief

CVE-2026-78637 is an argument injection vulnerability in Fdawgs node-poppler up to 9.1.2/10.0.1. The vulnerability affects the function pdfInfo/pdfToText/pdfToCairo/pdfToPpm/pdfImages/pdfToHtml/pdfToPs/pdfFonts/pdfDetach/pdfAttach/pdfSeparate/pdfUnite in src/index.js. The attack may be initiated remotely. A patch (db6e3f79d3beb20601be7e59669c39811ae3c330) is available.

Vendor
Fdawgs
Product
node-poppler
CVSS
MEDIUM 6.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-25
Original CVE updated
2026-09-28
Advisory published
2026-08-25
Advisory updated
2026-09-28

Who should care

Defenders and administrators using Fdawgs node-poppler up to 9.1.2/10.0.1 should assess exposure and apply the patch. They should also review compensating controls for exposed systems, monitor for potential remote attacks, and track exceptions and retest remediated assets. Security teams and vulnerability management teams should prioritize patching and review affected product deployments.

Why it matters

CVE-2026-78637 is an argument injection vulnerability in Fdawgs node-poppler. Defenders should apply the patch and review affected versions to prevent potential remote attacks.

  • Remote attackers may exploit this vulnerability
  • Apply patch to prevent potential attacks
  • Review affected versions and update node-poppler

Technical summary

The vulnerability is caused by improper handling of the file_path argument in the affected functions, leading to argument injection. A remote attacker could exploit this vulnerability by manipulating the file_path argument, potentially leading to unauthorized access or execution of arbitrary code. The patch (db6e3f79d3beb20601be7e59669c39811ae3c330) fixes this vulnerability by properly handling the file_path argument. Defenders should apply the patch and review affected versions to prevent potential remote attacks.

Defensive priority

Apply patch to fix argument injection vulnerability

Recommended defensive actions

  • Apply patch db6e3f79d3beb20601be7e59669c39811ae3c330 to fix vulnerability
  • Review and update affected versions of node-poppler
  • Monitor for potential remote attacks
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions, and patch information. The vulnerability is caused by improper handling of the file_path argument in the affected functions, leading to argument injection. A remote attacker could exploit this vulnerability. Defenders should verify affected product deployments, review official advisories, and plan vendor-supported updates or mitigations.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-78637 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-78637

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-78637 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-78637

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.