The Nodepdf Project maintains a specialized PDF generation library where observed disclosures center on command-injection vulnerabilities arising from insufficient sanitization of user-controlled input passed to system commands. This niche product footprint reflects the attack surface typical of libraries that bridge document rendering with shell execution, a pattern that defenders should monitor carefully when the library is integrated into web applications or automation workflows. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Nodepdf Project over time
Signals from CVEs in this vendor scope (1 CVEs).
1 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2016-4991CRITICAL Input passed to the Pdf() function is shell escaped and passed to child_process.exec() during PDF rendering. However, the shell escape does not properly encode all special characte | Jul 28, 2022 | 9.8 | 30 | NO | NO |
Signals from CVEs in this vendor scope (1 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Nodepdf Project.
Media articles that mention a CVE ID that affects a product developed by Nodepdf Project — matched by CVE ID, not by vendor name.