TI-2026-74130 CVE-2026-110636 · GHSA-hx4x-jq2f-pwr6OS command injection in pypdftk lets attackers run commandsPriority HIGH 81pypdftk through 0.5 contains an OS command injection vulnerability in fill_form(), dump_data_fields(), and pdftk_cmd_util() that builds shell commands from caller-supplied paths.CVSS 4.0CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.02691 · Published 2026-10-14 · No fix listed CWE-78