What’s Vulnerable › Vulnerabilities

CVE-2026-110642: xhtml2pdf before 0.2.19 OS Command Injection via startViewer File Name

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-14 · updated 2026-10-15
• Weakness: CWE-78

Description

xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer() that allows attackers to execute commands by interpolating unescaped file names into os.system. Attackers can supply an input file whose name contains a double quote and shell metacharacters, which runs OS commands as the invoking user when the pisa tool is used with -s/--start-viewer.

Affected products

• xhtml2pdf: before 0.2.19 — fixed in 0.2.19

How to fix

Upgrade to a fixed version: xhtml2pdf 0.2.19. Check the vendor advisory for mitigations.

References

• https://github.com/xhtml2pdf/xhtml2pdf/blob/v0.2.18/xhtml2pdf/pisa.py#L393-L400
• https://github.com/xhtml2pdf/xhtml2pdf/commit/f86380dad15b3a6810201d08755a3ee6b19d5063
• https://github.com/xhtml2pdf/xhtml2pdf/pull/835
• https://github.com/xhtml2pdf/xhtml2pdf/releases/tag/v0.2.19
• https://www.vulncheck.com/advisories/xhtml2pdf-before-0.2.19-os-command-injection-via-startviewer-file-name

Get alerted when CVE-2026-110642 or the next vulnerability affects your stack