CVE-2026-43893 exiftool-vendored: Argument injection via newline characters in tag names
Attackers can inject arguments via newlines in tag names, allowing ExifTool to read or write arbitrary files accessible to the process.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43893?
CVE-2026-43893 is a high-severity command injection vulnerability in photostructure exiftool-vendored.js, published on 11 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
exiftool-vendored provides cross-platform Node.js access to ExifTool. Prior to 35.19.0, exiftool-vendored starts ExifTool in -stay_open True -@ - mode, where arguments are read from stdin one per line. In affected versions, several caller-supplied strings were interpolated into ExifTool arguments without rejecting line delimiters. A newline or carriage return inside one of those strings could split a single intended argument into multiple ExifTool arguments, allowing argument injection. The fix also rejects NUL bytes as unsafe control characters. Applications that pass attacker-controlled strings to affected APIs may allow an attacker to make ExifTool read files accessible to the ExifTool process, or write output to attacker-chosen file system paths accessible to that process. No remote code execution has been demonstrated. This vulnerability is fixed in 35.19.0.
Weakness: CWE-88
Which versions are affected by CVE-2026-43893?
2 open source packages ship an affected version, including exiftool-vendored.
| Package | Affected | Fixed in |
|---|---|---|
exiftool-vendored npm | All versions | 35.19.0 |
exiftool-vendored npm | All versions | 35.19.0 |
How do I fix CVE-2026-43893?
Upgrade exiftool-vendored to 35.19.0 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-43893 being exploited?
There is no known exploitation of CVE-2026-43893 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-cw26-7653-2rp5.