{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-17431 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2026-17431 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-17431 is a medium-severity command injection vulnerability in MITHALDU PDF::WebKit, published on 12 Aug 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2026-17431 and fix it if it is affected.\n\nWhat it is: CVE-2026-17431 is a medium-severity command injection vulnerability in MITHALDU PDF::WebKit, published on 12 Aug 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of CVE-2026-17431 in the wild and no public exploit code.\n\nAffected product: MITHALDU PDF::WebKit. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-17431/ (Markdown: https://insights.sbomify.com/CVE-2026-17431/index.md)","id":"CVE-2026-17431","markdown":"https://insights.sbomify.com/CVE-2026-17431/index.md","name":"CVE-2026-17431","record":{"aliases":["GHSA-56v3-4wcg-g28h"],"analysis":{"component_type":"library","fix_type":"patch","impacts":["code_execution","data_modify"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Perl PDF library","requires_auth":"none","summary":"Attackers can execute arbitrary OS commands or modify files by supplying malicious paths to PDF::WebKit functions.","user_interaction":"required","vuln_class":"command_injection"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"CPANSec","cpe":[],"cvss":{"score":6.1,"severity":"medium","source":"cisa-adp","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N","version":"3.1"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"},{"id":"CWE-73","name":"External Control of File Name or Path"}],"description":"PDF::WebKit versions through 1.2 for Perl allow OS command injection via a 2-arg open() of the output path in to_pdf and of stylesheet paths in _style_tag_for.\n\nto_pdf reads the generated PDF back from its path argument, and _style_tag_for reads each entry of the stylesheets list, by assigning the path to a local @ARGV and reading it with the diamond operator, which opens each @ARGV element with Perl's 2-arg open(). A value that begins or ends with a pipe (\"| cmd\", \"cmd |\") is run as a command rather than opened as a file, and one that begins with a redirect (\"\u003e path\", \"\u003e\u003e path\") opens that path for write or append. to_file forwards its path argument to to_pdf and reaches the same read.\n\nAny caller that forwards untrusted input as the output path or as a stylesheets entry can run a command under the process UID; with the \"cmd |\" form the command's output is returned in place of the PDF, and with the \"\u003e path\" form the named file is truncated. Stylesheets may only be added to an HTML source, so a URL or file source exposes the output path alone.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":false,"headline":"Command injection in PDF::WebKit","id":"CVE-2026-17431","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"command_injection","year":"2026"},"n_packages":0,"n_references":3,"next":{"headline":"NousResearch hermes-agent SimpleX Gateway Authorization adapter.py access control","id":"CVE-2026-17432"},"packages":[],"prev":{"headline":"Power System Incorrect Authorization","id":"CVE-2026-17429"},"products":["PDF::WebKit"],"published":"2026-08-12","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-08-13","vendors":["MITHALDU"]},"summary":"Attackers can execute arbitrary OS commands or modify files by supplying malicious paths to PDF::WebKit functions.","url":"https://insights.sbomify.com/CVE-2026-17431/"}