CVE-2023-26155

CVE-2023-26155 is a critical command injection vulnerability affecting all versions of the node-qpdf package, specifically within its encrypt() method. This flaw allows unauthenticated attackers to inject arbitrary commands by manipulating the input PDF file path, leading to full system compromise (CVSS 9.8). While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion with 10 mentions, indicating awareness. Organizations using node-qpdf should prioritize patching or implementing input sanitization to mitigate this high-risk threat.