TI-2023-11379 CVE-2023-26155 · GHSA-fpr8-4wvx-j9q3OS command injection in node-qpdfPriority HIGH 81All versions of the package node-qpdf are vulnerable to Command Injection such that the package-exported method encrypt() fails to sanitize its parameter input, which later flows into a sensitive command execution API.CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02191 · Published 2023-10-14 · No fix listed CWE-78
