npmPackage

pdf-image

3 known vulnerabilities (1 critical), with the versions each affects and the releases that fix them.

Latest release: 2.0.0 (May 7, 2018): affected by 2 advisories
Newest unaffected release: Every release is affected by at least one advisory
Advisories: 3 · 1 critical

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-26830Critical 9.8
pdf-image (npm package) through version 2.0.0 allows OS command injection via the pdfFilePath parameter.
Affected: through 2.0.0.
No fix released. The latest release, 2.0.0, is still affected.
100% of pdf-image downloads last week were affected versions (13.9K).
CVE-2020-8132Unrated
Lack of input validation in pdf-image npm package version <= 2.0.0 may allow an attacker to run arbitrary code if PDF file path is…
Affected: through 2.0.0.
No fix released. The latest release, 2.0.0, is still affected.
100% of pdf-image downloads last week were affected versions (13.9K).
CVE-2018-3757Unrated
Command injection exists in pdf-image v2.0.0 due to an unescaped string parameter.
Affected: fixed in 2.0.0.
Fixed in 2.0.0 (released May 7, 2018, 25 days before disclosure).
The latest release, 2.0.0, is not affected.
2.7% of pdf-image downloads last week were affected versions (368).