xhtml2pdf CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH xhtml2pdf CVE published 2026-10-14

CVE-2026-110642

The xhtml2pdf library before version 0.2.19 contains an OS command injection vulnerability in the pisa.startViewer() function. This vulnerability allows attackers to execute OS commands by providing a specially crafted file name that interpolates unescaped shell metacharacters. The vulnerability is triggered when the pisa tool is used with the -s or --start-viewer option.